linux-kernel - [PATCH] Input: serio - clear serio event queue after sysfs driver rebind

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <1290467390-25302-1-git-send-email-dlaurie@chromium.org>
Date:	Mon, 22 Nov 2010 15:09:50 -0800
From:	Duncan Laurie <dlaurie@...omium.org>
To:	Dmitry Torokhov <dmitry.torokhov@...il.com>
Cc:	linux-input@...r.kernel.org, linux-kernel@...r.kernel.org,
	Duncan Laurie <dlaurie@...omium.org>
Subject: [PATCH] Input: serio - clear serio event queue after sysfs driver rebind

When rebinding a serio driver via sysfs drvctl interface it is possible for
an interrupt to trigger after the disconnect of the existing driver and
before the binding of the new driver.  This will cause the serio interrupt
handler to queue a rescan event which will disconnect the new driver
immediately after it is attached.

This change clears the serio event queue after processing the drvctl
request but before releasing the serio mutex, which will clear any queued
rescans before they can get processed.

Reproduction involves issuing a rebind of device port from psmouse driver
to serio_raw driver while generating input to trigger interrupts.  Then
checking to see if the corresponding i8042/serio4/driver is correctly
attached to the serio_raw driver instead of psmouse.

Signed-off-by: Duncan Laurie <dlaurie@...omium.org>
---
 drivers/input/serio/serio.c |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

diff --git a/drivers/input/serio/serio.c b/drivers/input/serio/serio.c
index 405bf21..a66307e 100644
--- a/drivers/input/serio/serio.c
+++ b/drivers/input/serio/serio.c
@@ -454,6 +454,7 @@ static ssize_t serio_rebind_driver(struct device *dev, struct device_attribute *
 		serio_disconnect_port(serio);
 		error = serio_bind_driver(serio, to_serio_driver(drv));
 		put_driver(drv);
+		serio_remove_pending_events(serio);
 	} else {
 		error = -EINVAL;
 	}
-- 
1.7.3.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/