[PATCH] Input: uinput - take event lock when submitting FF request "event"

[PATCH] Input: uinput - take event lock when submitting FF request "event"

[Dmitry Torokhov]

To avoid racing with FF playback events and corrupting device's event
queue take event_lock spinlock when calling uinput_dev_event() when
submitting a FF upload or erase "event".

Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---

Mikhail, could you please try this one?

 drivers/input/misc/uinput.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c
index e24caf6fc8e8..d32fa4b508fc 100644
--- a/drivers/input/misc/uinput.c
+++ b/drivers/input/misc/uinput.c
@@ -25,8 +25,10 @@
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/fs.h>
+#include <linux/lockdep.h>
 #include <linux/miscdevice.h>
 #include <linux/overflow.h>
+#include <linux/spinlock.h>
 #include <linux/input/mt.h>
 #include "../input-compat.h"
 
@@ -76,6 +78,8 @@ static int uinput_dev_event(struct input_dev *dev,
 	struct uinput_device	*udev = input_get_drvdata(dev);
 	struct timespec64	ts;
 
+	lockdep_assert_held(&dev->event_lock);
+
 	ktime_get_ts64(&ts);
 
 	udev->buff[udev->head] = (struct input_event) {
@@ -147,6 +151,7 @@ static void uinput_request_release_slot(struct uinput_device *udev,
 static int uinput_request_send(struct uinput_device *udev,
 			       struct uinput_request *request)
 {
+	unsigned long flags;
 	int retval = 0;
 
 	spin_lock(&udev->state_lock);
@@ -160,7 +165,9 @@ static int uinput_request_send(struct uinput_device *udev,
 	 * Tell our userspace application about this new request
 	 * by queueing an input event.
 	 */
+	spin_lock_irqsave(&udev->dev->event_lock, flags);
 	uinput_dev_event(udev->dev, EV_UINPUT, request->code, request->id);
+	spin_unlock_irqrestore(&udev->dev->event_lock, flags);
 
  out:
 	spin_unlock(&udev->state_lock);
-- 
2.53.0.1213.gd9a14994de-goog


-- 
Dmitry

Re: [PATCH] Input: uinput - take event lock when submitting FF request "event"

[Mikhail Gavrilov]

On Wed, Apr 8, 2026 at 10:16 AM Dmitry Torokhov
<dmitry.torokhov@gmail.com> wrote:
>
> To avoid racing with FF playback events and corrupting device's event
> queue take event_lock spinlock when calling uinput_dev_event() when
> submitting a FF upload or erase "event".
>
> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
> ---
>
> Mikhail, could you please try this one?
>
>  drivers/input/misc/uinput.c | 7 +++++++
>  1 file changed, 7 insertions(+)
>
> diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c
> index e24caf6fc8e8..d32fa4b508fc 100644
> --- a/drivers/input/misc/uinput.c
> +++ b/drivers/input/misc/uinput.c
> @@ -25,8 +25,10 @@
>  #include <linux/module.h>
>  #include <linux/init.h>
>  #include <linux/fs.h>
> +#include <linux/lockdep.h>
>  #include <linux/miscdevice.h>
>  #include <linux/overflow.h>
> +#include <linux/spinlock.h>
>  #include <linux/input/mt.h>
>  #include "../input-compat.h"
>
> @@ -76,6 +78,8 @@ static int uinput_dev_event(struct input_dev *dev,
>         struct uinput_device    *udev = input_get_drvdata(dev);
>         struct timespec64       ts;
>
> +       lockdep_assert_held(&dev->event_lock);
> +
>         ktime_get_ts64(&ts);
>
>         udev->buff[udev->head] = (struct input_event) {
> @@ -147,6 +151,7 @@ static void uinput_request_release_slot(struct uinput_device *udev,
>  static int uinput_request_send(struct uinput_device *udev,
>                                struct uinput_request *request)
>  {
> +       unsigned long flags;
>         int retval = 0;
>
>         spin_lock(&udev->state_lock);
> @@ -160,7 +165,9 @@ static int uinput_request_send(struct uinput_device *udev,
>          * Tell our userspace application about this new request
>          * by queueing an input event.
>          */
> +       spin_lock_irqsave(&udev->dev->event_lock, flags);
>         uinput_dev_event(udev->dev, EV_UINPUT, request->code, request->id);
> +       spin_unlock_irqrestore(&udev->dev->event_lock, flags);
>
>   out:
>         spin_unlock(&udev->state_lock);
> --
> 2.53.0.1213.gd9a14994de-goog
>
>
> --
> Dmitry

Applied on top of my v2 patch, built and tested with Flydigi Vader 5
controller under Wine (ELDEN RING, Resident Evil Requiem) -- no issues observed.

Tested-by: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com>

-- 
Best Regards,
Mike Gavrilov.