From: Jean-Baptiste Maneyrol <jmaneyrol@xxxxxxxxxxxxxx>
From: Jean-Baptiste Maneyrol <jmaneyrol@xxxxxxxxxxxxxx>
Current driver uses a common buffer for reading reports either
synchronously in i2c_hid_get_raw_report() and asynchronously in
the interrupt handler.
There is race condition if an interrupt arrives immediately after
the report is received in i2c_hid_get_raw_report(); the common
buffer is modified by the interrupt handler with the new report
and then i2c_hid_get_raw_report() proceed using wrong data.
Fix it by using a separate buffers for asynchronous reports.
Signed-off-by: Jean-Baptiste Maneyrol <jmaneyrol@xxxxxxxxxxxxxx>
[Antonio Borneo: cleanup and rebase to v3.17]
Signed-off-by: Antonio Borneo <borneo.antonio@xxxxxxxxx>
Cc: stable@xxxxxxxxxxxxxxx
---
Hi Jiri, Benjamin,
I think this patch should also go through linux-stable.
Confirmation from our side is welcome.
Regards,
Antonio
drivers/hid/i2c-hid/i2c-hid.c | 17 +++++++++++------
1 file changed, 11 insertions(+), 6 deletions(-)
diff --git a/drivers/hid/i2c-hid/i2c-hid.c b/drivers/hid/i2c-hid/i2c-hid.c
index 933bf10..7c80e96 100644
--- a/drivers/hid/i2c-hid/i2c-hid.c
+++ b/drivers/hid/i2c-hid/i2c-hid.c
@@ -136,6 +136,7 @@ struct i2c_hid {
* register of the HID
* descriptor. */
unsigned int bufsize; /* i2c buffer size */
+ char *irqinbuf; /* Asynchronous Input buffer */
char *inbuf; /* Input buffer */
char *cmdbuf; /* Command buffer */
char *argsbuf; /* Command arguments buffer */
@@ -371,7 +372,7 @@ static void i2c_hid_get_input(struct i2c_hid *ihid)
int ret, ret_size;
int size = le16_to_cpu(ihid->hdesc.wMaxInputLength);
- ret = i2c_master_recv(ihid->client, ihid->inbuf, size);
+ ret = i2c_master_recv(ihid->client, ihid->irqinbuf, size);
if (ret != size) {
if (ret < 0)
return;
@@ -381,7 +382,7 @@ static void i2c_hid_get_input(struct i2c_hid *ihid)
return;
}
- ret_size = ihid->inbuf[0] | ihid->inbuf[1] << 8;
+ ret_size = ihid->irqinbuf[0] | ihid->irqinbuf[1] << 8;
if (!ret_size) {
/* host or device initiated RESET completed */
@@ -396,11 +397,11 @@ static void i2c_hid_get_input(struct i2c_hid *ihid)
return;
}
- i2c_hid_dbg(ihid, "input: %*ph\n", ret_size, ihid->inbuf);
+ i2c_hid_dbg(ihid, "input: %*ph\n", ret_size, ihid->irqinbuf);
if (test_bit(I2C_HID_STARTED, &ihid->flags))
- hid_input_report(ihid->hid, HID_INPUT_REPORT, ihid->inbuf + 2,
- ret_size - 2, 1);
+ hid_input_report(ihid->hid, HID_INPUT_REPORT,
+ ihid->irqinbuf + 2, ret_size - 2, 1);
return;
}
@@ -503,9 +504,11 @@ static void i2c_hid_find_max_report(struct hid_device *hid, unsigned int type,
static void i2c_hid_free_buffers(struct i2c_hid *ihid)
{
+ kfree(ihid->irqinbuf);
kfree(ihid->inbuf);
kfree(ihid->argsbuf);
kfree(ihid->cmdbuf);
+ ihid->irqinbuf = NULL;
ihid->inbuf = NULL;
ihid->cmdbuf = NULL;
ihid->argsbuf = NULL;
@@ -521,11 +524,13 @@ static int i2c_hid_alloc_buffers(struct i2c_hid *ihid, size_t report_size)
sizeof(__u16) + /* size of the report */
report_size; /* report */
+ ihid->irqinbuf = kzalloc(report_size, GFP_KERNEL);
ihid->inbuf = kzalloc(report_size, GFP_KERNEL);
ihid->argsbuf = kzalloc(args_len, GFP_KERNEL);
ihid->cmdbuf = kzalloc(sizeof(union command) + args_len, GFP_KERNEL);
- if (!ihid->inbuf || !ihid->argsbuf || !ihid->cmdbuf) {
+ if (!ihid->irqinbuf || !ihid->inbuf ||
+ !ihid->argsbuf || !ihid->cmdbuf) {
i2c_hid_free_buffers(ihid);
return -ENOMEM;
}
--
2.1.3
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html