277fe44dd8
It is unsafe to call list_for_each_entry in hidraw_report_event to traverse each hidraw_list node without a lock protection, the list could be modified if someone calls hidraw_release and list_del to remove itself from the list, this can cause hidraw_report_event to touch a deleted list struct and panic. To prevent this, introduce a spinlock in struct hidraw to protect list from concurrent access. Signed-off-by: Yonghua Zheng <younghua.zheng@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
60 lines
1.5 KiB
C
60 lines
1.5 KiB
C
/*
|
|
* Copyright (c) 2007 Jiri Kosina
|
|
*/
|
|
/*
|
|
* This program is free software; you can redistribute it and/or modify it
|
|
* under the terms and conditions of the GNU General Public License,
|
|
* version 2, as published by the Free Software Foundation.
|
|
*
|
|
* You should have received a copy of the GNU General Public License along with
|
|
* this program; if not, write to the Free Software Foundation, Inc.,
|
|
* 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
|
|
*/
|
|
#ifndef _HIDRAW_H
|
|
#define _HIDRAW_H
|
|
|
|
#include <uapi/linux/hidraw.h>
|
|
|
|
|
|
struct hidraw {
|
|
unsigned int minor;
|
|
int exist;
|
|
int open;
|
|
wait_queue_head_t wait;
|
|
struct hid_device *hid;
|
|
struct device *dev;
|
|
spinlock_t list_lock;
|
|
struct list_head list;
|
|
};
|
|
|
|
struct hidraw_report {
|
|
__u8 *value;
|
|
int len;
|
|
};
|
|
|
|
struct hidraw_list {
|
|
struct hidraw_report buffer[HIDRAW_BUFFER_SIZE];
|
|
int head;
|
|
int tail;
|
|
struct fasync_struct *fasync;
|
|
struct hidraw *hidraw;
|
|
struct list_head node;
|
|
struct mutex read_mutex;
|
|
};
|
|
|
|
#ifdef CONFIG_HIDRAW
|
|
int hidraw_init(void);
|
|
void hidraw_exit(void);
|
|
int hidraw_report_event(struct hid_device *, u8 *, int);
|
|
int hidraw_connect(struct hid_device *);
|
|
void hidraw_disconnect(struct hid_device *);
|
|
#else
|
|
static inline int hidraw_init(void) { return 0; }
|
|
static inline void hidraw_exit(void) { }
|
|
static inline int hidraw_report_event(struct hid_device *hid, u8 *data, int len) { return 0; }
|
|
static inline int hidraw_connect(struct hid_device *hid) { return -1; }
|
|
static inline void hidraw_disconnect(struct hid_device *hid) { }
|
|
#endif
|
|
|
|
#endif
|