linux-kernel - [PATCH 5/5] input: evdev: Never leave the client buffer empty after write

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <1277291686-7153-6-git-send-email-rydberg@euromail.se>
Date:	Wed, 23 Jun 2010 13:14:46 +0200
From:	"Henrik Rydberg" <rydberg@...omail.se>
To:	Dmitry Torokhov <dmitry.torokhov@...il.com>
Cc:	linux-input@...r.kernel.org, linux-kernel@...r.kernel.org,
	Jiri Kosina <jkosina@...e.cz>, Ping Cheng <pingc@...om.com>,
	Benjamin Tissoires <tissoire@...a.fr>,
	Chase Douglas <chase.douglas@...onical.com>,
	Rafi Rubin <rafi@...s.upenn.edu>,
	Henrik Rydberg <rydberg@...omail.se>
Subject: [PATCH 5/5] input: evdev: Never leave the client buffer empty after write

When the client buffer is very small and wraps around a lot, it may
well be that a write increases the head such that head == tail. If
this happens between the point where a poll is triggered and the
actual data is being read, there will be no data to read. This is
confusing to applications, which might end up closing the file.

This patch solves the problem by making sure the client buffer is
never empty after writing to it.

Signed-off-by: Henrik Rydberg <rydberg@...omail.se>
---
 drivers/input/evdev.c |    7 +++++--
 1 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c
index 728802f..45eae19 100644
--- a/drivers/input/evdev.c
+++ b/drivers/input/evdev.c
@@ -62,10 +62,13 @@ static void evdev_pass_event(struct evdev_client *client,
 {
 	/*
 	 * Interrupts are disabled, just acquire the lock
+	 * Never leave the client buffer empty
 	 */
 	spin_lock(&client->buffer_lock);
-	client->buffer[client->head++] = *event;
-	client->head &= client->bufsize - 1;
+	do {
+		client->buffer[client->head++] = *event;
+		client->head &= client->bufsize - 1;
+	} while (client->head == client->tail);
 	spin_unlock(&client->buffer_lock);
 
 	if (event->type == EV_SYN)
-- 
1.6.3.3

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/