* [PATCH] Input: evdev: fix data race in evdev_read() and evdev_poll()
@ 2026-02-08 19:45 Osama Abdelkader
2026-02-26 15:17 ` Osama Abdelkader
0 siblings, 1 reply; 2+ messages in thread
From: Osama Abdelkader @ 2026-02-08 19:45 UTC (permalink / raw)
To: Dmitry Torokhov, linux-input, linux-kernel
Cc: Osama Abdelkader, syzbot+1b327485934adf39955b
Protect all reads of client->packet_head with buffer_lock to fix a
KCSAN-reported data race. The race occurs between:
- evdev_pass_values() writing to packet_head (protected by buffer_lock)
- evdev_read() reading packet_head without lock protection
- evdev_poll() reading packet_head without lock protection
The fix ensures all accesses to packet_head are protected by buffer_lock,
matching the existing write-side protection pattern used in
evdev_pass_values() and evdev_fetch_next_event().
Changes:
- evdev_read(): Protect packet_head read in O_NONBLOCK check
- evdev_read(): Protect packet_head read in wait loop condition
- evdev_poll(): Protect packet_head read in poll check
KCSAN report:
BUG: KCSAN: data-race in evdev_pass_values / evdev_read
write to 0xffff888104842008 of 4 bytes by task 8439 on cpu 1:
__pass_event drivers/input/evdev.c:239 [inline]
evdev_pass_values+0x387/0x4e0 drivers/input/evdev.c:278
evdev_events+0x8e/0xd0 drivers/input/evdev.c:306
input_pass_values+0x123/0x390 drivers/input/input.c:128
input_event_dispose+0x248/0x320 drivers/input/input.c:342
input_handle_event+0x9e8/0xa20 drivers/input/input.c:370
input_inject_event+0xbc/0x120 drivers/input/input.c:424
evdev_write+0x224/0x2b0 drivers/input/evdev.c:528
vfs_write+0x269/0x9f0 fs/read_write.c:684
ksys_write+0xdc/0x1a0 fs/read_write.c:738
__do_sys_write fs/read_write.c:749 [inline]
__se_sys_write fs/read_write.c:746 [inline]
__x64_sys_write+0x40/0x50 fs/read_write.c:746
x64_sys_call+0x2847/0x3000 arch/x86/include/generated/asm/syscalls_64.h:2
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xc0/0x2a0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
read to 0xffff888104842008 of 4 bytes by task 2991 on cpu 0:
evdev_read+0x157/0x5e0 drivers/input/evdev.c:572
vfs_read+0x1ab/0x7f0 fs/read_write.c:570
ksys_read+0xdc/0x1a0 fs/read_write.c:715
__do_sys_read fs/read_write.c:724 [inline]
__se_sys_read fs/read_write.c:722 [inline]
__x64_sys_read+0x40/0x50 fs/read_write.c:722
x64_sys_call+0x2889/0x3000 arch/x86/include/generated/asm/syscalls_64.h:1
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xc0/0x2a0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
value changed: 0x00000002 -> 0x00000004
Reported-by: syzbot+1b327485934adf39955b@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=1b327485934adf39955b
Signed-off-by: Osama Abdelkader <osama.abdelkader@gmail.com>
---
drivers/input/evdev.c | 20 ++++++++++++++++----
1 file changed, 16 insertions(+), 4 deletions(-)
diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c
index 90ff6be85cf4..eebd59d190f5 100644
--- a/drivers/input/evdev.c
+++ b/drivers/input/evdev.c
@@ -569,9 +569,13 @@ static ssize_t evdev_read(struct file *file, char __user *buffer,
if (!evdev->exist || client->revoked)
return -ENODEV;
+ spin_lock_irq(&client->buffer_lock);
if (client->packet_head == client->tail &&
- (file->f_flags & O_NONBLOCK))
+ (file->f_flags & O_NONBLOCK)) {
+ spin_unlock_irq(&client->buffer_lock);
return -EAGAIN;
+ }
+ spin_unlock_irq(&client->buffer_lock);
/*
* count == 0 is special - no IO is done but we check
@@ -593,9 +597,12 @@ static ssize_t evdev_read(struct file *file, char __user *buffer,
break;
if (!(file->f_flags & O_NONBLOCK)) {
- error = wait_event_interruptible(client->wait,
+ spin_lock_irq(&client->buffer_lock);
+ error = wait_event_interruptible_lock_irq(client->wait,
client->packet_head != client->tail ||
- !evdev->exist || client->revoked);
+ !evdev->exist || client->revoked,
+ client->buffer_lock);
+ spin_unlock_irq(&client->buffer_lock);
if (error)
return error;
}
@@ -610,6 +617,7 @@ static __poll_t evdev_poll(struct file *file, poll_table *wait)
struct evdev_client *client = file->private_data;
struct evdev *evdev = client->evdev;
__poll_t mask;
+ bool have_data;
poll_wait(file, &client->wait, wait);
@@ -618,7 +626,11 @@ static __poll_t evdev_poll(struct file *file, poll_table *wait)
else
mask = EPOLLHUP | EPOLLERR;
- if (client->packet_head != client->tail)
+ spin_lock_irq(&client->buffer_lock);
+ have_data = client->packet_head != client->tail;
+ spin_unlock_irq(&client->buffer_lock);
+
+ if (have_data)
mask |= EPOLLIN | EPOLLRDNORM;
return mask;
--
2.43.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] Input: evdev: fix data race in evdev_read() and evdev_poll()
2026-02-08 19:45 [PATCH] Input: evdev: fix data race in evdev_read() and evdev_poll() Osama Abdelkader
@ 2026-02-26 15:17 ` Osama Abdelkader
0 siblings, 0 replies; 2+ messages in thread
From: Osama Abdelkader @ 2026-02-26 15:17 UTC (permalink / raw)
To: Dmitry Torokhov, linux-input, linux-kernel; +Cc: syzbot+1b327485934adf39955b
On Sun, Feb 08, 2026 at 08:45:15PM +0100, Osama Abdelkader wrote:
> Protect all reads of client->packet_head with buffer_lock to fix a
> KCSAN-reported data race. The race occurs between:
>
> - evdev_pass_values() writing to packet_head (protected by buffer_lock)
> - evdev_read() reading packet_head without lock protection
> - evdev_poll() reading packet_head without lock protection
>
> The fix ensures all accesses to packet_head are protected by buffer_lock,
> matching the existing write-side protection pattern used in
> evdev_pass_values() and evdev_fetch_next_event().
>
> Changes:
> - evdev_read(): Protect packet_head read in O_NONBLOCK check
> - evdev_read(): Protect packet_head read in wait loop condition
> - evdev_poll(): Protect packet_head read in poll check
>
> KCSAN report:
> BUG: KCSAN: data-race in evdev_pass_values / evdev_read
>
> write to 0xffff888104842008 of 4 bytes by task 8439 on cpu 1:
> __pass_event drivers/input/evdev.c:239 [inline]
> evdev_pass_values+0x387/0x4e0 drivers/input/evdev.c:278
> evdev_events+0x8e/0xd0 drivers/input/evdev.c:306
> input_pass_values+0x123/0x390 drivers/input/input.c:128
> input_event_dispose+0x248/0x320 drivers/input/input.c:342
> input_handle_event+0x9e8/0xa20 drivers/input/input.c:370
> input_inject_event+0xbc/0x120 drivers/input/input.c:424
> evdev_write+0x224/0x2b0 drivers/input/evdev.c:528
> vfs_write+0x269/0x9f0 fs/read_write.c:684
> ksys_write+0xdc/0x1a0 fs/read_write.c:738
> __do_sys_write fs/read_write.c:749 [inline]
> __se_sys_write fs/read_write.c:746 [inline]
> __x64_sys_write+0x40/0x50 fs/read_write.c:746
> x64_sys_call+0x2847/0x3000 arch/x86/include/generated/asm/syscalls_64.h:2
> do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
> do_syscall_64+0xc0/0x2a0 arch/x86/entry/syscall_64.c:94
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
>
> read to 0xffff888104842008 of 4 bytes by task 2991 on cpu 0:
> evdev_read+0x157/0x5e0 drivers/input/evdev.c:572
> vfs_read+0x1ab/0x7f0 fs/read_write.c:570
> ksys_read+0xdc/0x1a0 fs/read_write.c:715
> __do_sys_read fs/read_write.c:724 [inline]
> __se_sys_read fs/read_write.c:722 [inline]
> __x64_sys_read+0x40/0x50 fs/read_write.c:722
> x64_sys_call+0x2889/0x3000 arch/x86/include/generated/asm/syscalls_64.h:1
> do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
> do_syscall_64+0xc0/0x2a0 arch/x86/entry/syscall_64.c:94
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
>
> value changed: 0x00000002 -> 0x00000004
>
> Reported-by: syzbot+1b327485934adf39955b@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=1b327485934adf39955b
> Signed-off-by: Osama Abdelkader <osama.abdelkader@gmail.com>
> ---
> drivers/input/evdev.c | 20 ++++++++++++++++----
> 1 file changed, 16 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c
> index 90ff6be85cf4..eebd59d190f5 100644
> --- a/drivers/input/evdev.c
> +++ b/drivers/input/evdev.c
> @@ -569,9 +569,13 @@ static ssize_t evdev_read(struct file *file, char __user *buffer,
> if (!evdev->exist || client->revoked)
> return -ENODEV;
>
> + spin_lock_irq(&client->buffer_lock);
> if (client->packet_head == client->tail &&
> - (file->f_flags & O_NONBLOCK))
> + (file->f_flags & O_NONBLOCK)) {
> + spin_unlock_irq(&client->buffer_lock);
> return -EAGAIN;
> + }
> + spin_unlock_irq(&client->buffer_lock);
>
> /*
> * count == 0 is special - no IO is done but we check
> @@ -593,9 +597,12 @@ static ssize_t evdev_read(struct file *file, char __user *buffer,
> break;
>
> if (!(file->f_flags & O_NONBLOCK)) {
> - error = wait_event_interruptible(client->wait,
> + spin_lock_irq(&client->buffer_lock);
> + error = wait_event_interruptible_lock_irq(client->wait,
> client->packet_head != client->tail ||
> - !evdev->exist || client->revoked);
> + !evdev->exist || client->revoked,
> + client->buffer_lock);
> + spin_unlock_irq(&client->buffer_lock);
> if (error)
> return error;
> }
> @@ -610,6 +617,7 @@ static __poll_t evdev_poll(struct file *file, poll_table *wait)
> struct evdev_client *client = file->private_data;
> struct evdev *evdev = client->evdev;
> __poll_t mask;
> + bool have_data;
>
> poll_wait(file, &client->wait, wait);
>
> @@ -618,7 +626,11 @@ static __poll_t evdev_poll(struct file *file, poll_table *wait)
> else
> mask = EPOLLHUP | EPOLLERR;
>
> - if (client->packet_head != client->tail)
> + spin_lock_irq(&client->buffer_lock);
> + have_data = client->packet_head != client->tail;
> + spin_unlock_irq(&client->buffer_lock);
> +
> + if (have_data)
> mask |= EPOLLIN | EPOLLRDNORM;
>
> return mask;
> --
> 2.43.0
>
ping
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-02-26 15:17 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-02-08 19:45 [PATCH] Input: evdev: fix data race in evdev_read() and evdev_poll() Osama Abdelkader
2026-02-26 15:17 ` Osama Abdelkader
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox