lkml.org 
[lkml]   [2014]   [Nov]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH] HID: i2c-hid: fix race condition reading reports
Date
From: Jean-Baptiste Maneyrol <jmaneyrol@invensense.com>

From: Jean-Baptiste Maneyrol <jmaneyrol@invensense.com>

Current driver uses a common buffer for reading reports either
synchronously in i2c_hid_get_raw_report() and asynchronously in
the interrupt handler.
There is race condition if an interrupt arrives immediately after
the report is received in i2c_hid_get_raw_report(); the common
buffer is modified by the interrupt handler with the new report
and then i2c_hid_get_raw_report() proceed using wrong data.

Fix it by using a separate buffers for asynchronous reports.

Signed-off-by: Jean-Baptiste Maneyrol <jmaneyrol@invensense.com>
[Antonio Borneo: cleanup and rebase to v3.17]
Signed-off-by: Antonio Borneo <borneo.antonio@gmail.com>
Cc: stable@vger.kernel.org
---

Hi Jiri, Benjamin,

I think this patch should also go through linux-stable.
Confirmation from our side is welcome.

Regards,
Antonio

drivers/hid/i2c-hid/i2c-hid.c | 17 +++++++++++------
1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/drivers/hid/i2c-hid/i2c-hid.c b/drivers/hid/i2c-hid/i2c-hid.c
index 933bf10..7c80e96 100644
--- a/drivers/hid/i2c-hid/i2c-hid.c
+++ b/drivers/hid/i2c-hid/i2c-hid.c
@@ -136,6 +136,7 @@ struct i2c_hid {
* register of the HID
* descriptor. */
unsigned int bufsize; /* i2c buffer size */
+ char *irqinbuf; /* Asynchronous Input buffer */
char *inbuf; /* Input buffer */
char *cmdbuf; /* Command buffer */
char *argsbuf; /* Command arguments buffer */
@@ -371,7 +372,7 @@ static void i2c_hid_get_input(struct i2c_hid *ihid)
int ret, ret_size;
int size = le16_to_cpu(ihid->hdesc.wMaxInputLength);

- ret = i2c_master_recv(ihid->client, ihid->inbuf, size);
+ ret = i2c_master_recv(ihid->client, ihid->irqinbuf, size);
if (ret != size) {
if (ret < 0)
return;
@@ -381,7 +382,7 @@ static void i2c_hid_get_input(struct i2c_hid *ihid)
return;
}

- ret_size = ihid->inbuf[0] | ihid->inbuf[1] << 8;
+ ret_size = ihid->irqinbuf[0] | ihid->irqinbuf[1] << 8;

if (!ret_size) {
/* host or device initiated RESET completed */
@@ -396,11 +397,11 @@ static void i2c_hid_get_input(struct i2c_hid *ihid)
return;
}

- i2c_hid_dbg(ihid, "input: %*ph\n", ret_size, ihid->inbuf);
+ i2c_hid_dbg(ihid, "input: %*ph\n", ret_size, ihid->irqinbuf);

if (test_bit(I2C_HID_STARTED, &ihid->flags))
- hid_input_report(ihid->hid, HID_INPUT_REPORT, ihid->inbuf + 2,
- ret_size - 2, 1);
+ hid_input_report(ihid->hid, HID_INPUT_REPORT,
+ ihid->irqinbuf + 2, ret_size - 2, 1);

return;
}
@@ -503,9 +504,11 @@ static void i2c_hid_find_max_report(struct hid_device *hid, unsigned int type,

static void i2c_hid_free_buffers(struct i2c_hid *ihid)
{
+ kfree(ihid->irqinbuf);
kfree(ihid->inbuf);
kfree(ihid->argsbuf);
kfree(ihid->cmdbuf);
+ ihid->irqinbuf = NULL;
ihid->inbuf = NULL;
ihid->cmdbuf = NULL;
ihid->argsbuf = NULL;
@@ -521,11 +524,13 @@ static int i2c_hid_alloc_buffers(struct i2c_hid *ihid, size_t report_size)
sizeof(__u16) + /* size of the report */
report_size; /* report */

+ ihid->irqinbuf = kzalloc(report_size, GFP_KERNEL);
ihid->inbuf = kzalloc(report_size, GFP_KERNEL);
ihid->argsbuf = kzalloc(args_len, GFP_KERNEL);
ihid->cmdbuf = kzalloc(sizeof(union command) + args_len, GFP_KERNEL);

- if (!ihid->inbuf || !ihid->argsbuf || !ihid->cmdbuf) {
+ if (!ihid->irqinbuf || !ihid->inbuf ||
+ !ihid->argsbuf || !ihid->cmdbuf) {
i2c_hid_free_buffers(ihid);
return -ENOMEM;
}
--
2.1.3


\
 
 \ /
  Last update: 2014-11-16 16:21    [W:0.061 / U:0.784 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site