* Input: uinput - race after request submit tiemout
@ 2024-05-21 11:36 Hillf Danton
0 siblings, 0 replies; only message in thread
From: Hillf Danton @ 2024-05-21 11:36 UTC (permalink / raw)
To: linux-input
Cc: Dmitry Torokhov, Krzysztof Kozlowski, Tetsuo Handa,
Linus Torvalds, linux-kernel
uinput_request_submit() uinput_ioctl_handler()
--- ---
wait_for_completion_timeout() case UI_END_FF_ERASE:
req = uinput_request_find()
uinput_request_release_slot()
req->retval = ff_erase.retval;
complete(&req->done);
Given the race between request submit and ioctl handler, memory corruption
could happen after releasing request slot.
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2024-05-21 11:37 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-05-21 11:36 Input: uinput - race after request submit tiemout Hillf Danton
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox