Re: [PATCH] Input: fixed EVIOCGRAB iterative grab/release.

["Henrik Rydberg" <rydberg@euromail.se>]

Hi Terry,

> Fixed order of calls in evdev_ungrab to allow iterative use of
> code which grabs and releases input event devices.
> 
> Signed-off-by: Terry Lambert <tlambert@chromium.org>
> ---
>  drivers/input/evdev.c |    2 +-
>  1 files changed, 1 insertions(+), 1 deletions(-)
> 
> diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c
> index c8471a2..0bac8da 100644
> --- a/drivers/input/evdev.c
> +++ b/drivers/input/evdev.c
> @@ -160,9 +160,9 @@ static int evdev_ungrab(struct evdev *evdev, struct evdev_client *client)
>  	if (evdev->grab != client)
>  		return  -EINVAL;
>  
> +	input_release_device(&evdev->handle);
>  	rcu_assign_pointer(evdev->grab, NULL);
>  	synchronize_rcu();
> -	input_release_device(&evdev->handle);

I imagine the current code could lead to a race situation if there
were no other locks involved. However, evdev_ungrab() is always called
under evdev->mutex. As Dmitry hinted, grabbing "usually works", so
perhaps you could device a tiny program which reproduces the problem?

Thanks,
Henrik