| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20130718171345.GB32381@polaris.bitmath.org>
Date: Thu, 18 Jul 2013 19:13:45 +0200
From: rydberg@...omail.se
To: Nick Dyer <nick.dyer@...ev.co.uk>
Cc: Dmitry Torokhov <dmitry.torokhov@...il.com>,
Daniel Kurtz <djkurtz@...omium.org>,
Joonyoung Shim <jy0922.shim@...sung.com>,
Alan Bowens <Alan.Bowens@...el.com>,
linux-input@...r.kernel.org, linux-kernel@...r.kernel.org,
Peter Meerwald <pmeerw@...erw.net>,
Benson Leung <bleung@...omium.org>,
Olof Johansson <olofj@...omium.org>
Subject: Re: [PATCH 08/51] Input: atmel_mxt_ts - Initialise IRQ before probing
Hi Nick,
> This allows the interrupt handler to be used to detect CHG line during config
> download. We need to make sure we do not report events if input device not yet
> registered.
>
> data->enable_reporting is checked in each of the possible message handling
> function paths rather than higher up (such as at mxt_proc_message) because
> some objects may be used for completions (T6).
>
> Signed-off-by: Nick Dyer <nick.dyer@...ev.co.uk>
> Acked-by: Benson Leung <bleung@...omium.org>
> ---
> drivers/input/touchscreen/atmel_mxt_ts.c | 73 +++++++++++++++++++++---------
> 1 file changed, 51 insertions(+), 22 deletions(-)
>
> diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c b/drivers/input/touchscreen/atmel_mxt_ts.c
> index 55d7667..1e24e54 100644
> --- a/drivers/input/touchscreen/atmel_mxt_ts.c
> +++ b/drivers/input/touchscreen/atmel_mxt_ts.c
> @@ -2,6 +2,7 @@
> * Atmel maXTouch Touchscreen driver
> *
> * Copyright (C) 2010 Samsung Electronics Co.Ltd
> + * Copyright (C) 2011-2012 Atmel Corporation
> * Copyright (C) 2012 Google, Inc.
> *
> * Author: Joonyoung Shim <jy0922.shim@...sung.com>
> @@ -261,6 +262,9 @@ struct mxt_data {
>
> /* for fw update in bootloader */
> struct completion bl_completion;
> +
> + /* Enable reporting of input events */
> + bool enable_reporting;
> };
>
> static inline size_t mxt_obj_size(const struct mxt_object *obj)
> @@ -568,6 +572,10 @@ static void mxt_input_button(struct mxt_data *data, struct mxt_message *message)
> bool button;
> int i;
>
> + /* do not report events if input device not yet registered */
> + if (!data->enable_reporting)
> + return;
Regardless of the rationale, this test seems to create complex logic
further down the patchset. Any chance it could be done differently?
> +
> /* Active-low switch */
> for (i = 0; i < pdata->t19_num_keys; i++) {
> if (pdata->t19_keymap[i] == KEY_RESERVED)
> @@ -588,6 +596,10 @@ static void mxt_input_touchevent(struct mxt_data *data,
> int area;
> int pressure;
>
> + /* do not report events if input device not yet registered */
> + if (!data->enable_reporting)
> + return;
> +
> x = (message->message[1] << 4) | ((message->message[3] >> 4) & 0xf);
> y = (message->message[2] << 4) | ((message->message[3] & 0xf));
> if (data->max_x < 1024)
> @@ -667,7 +679,7 @@ static irqreturn_t mxt_process_messages_until_invalid(struct mxt_data *data)
> }
> } while (reportid != 0xff);
>
> - if (update_input) {
> + if (data->enable_reporting && update_input) {
> input_mt_report_pointer_emulation(data->input_dev, false);
> input_sync(data->input_dev);
> }
> @@ -685,6 +697,9 @@ static irqreturn_t mxt_interrupt(int irq, void *dev_id)
> return IRQ_HANDLED;
> }
>
> + if (!data->object_table)
> + return IRQ_NONE;
> +
> return mxt_process_messages_until_invalid(data);
> }
>
> @@ -746,6 +761,19 @@ static int mxt_make_highchg(struct mxt_data *data)
> return 0;
> }
>
> +static int mxt_acquire_irq(struct mxt_data *data)
> +{
> + int error;
> +
> + enable_irq(data->irq);
> +
> + error = mxt_make_highchg(data);
> + if (error)
> + return error;
> +
> + return 0;
> +}
> +
Strange error handling; the name suggests that an error means the irq
has not been enabled, which it clearly does anyways. Also, the error
is not checked everywhere later in the patchset. Opencode instead?
> static int mxt_get_info(struct mxt_data *data)
> {
> struct i2c_client *client = data->client;
> @@ -819,6 +847,7 @@ static void mxt_free_object_table(struct mxt_data *data)
> {
> kfree(data->object_table);
> data->object_table = NULL;
> + data->enable_reporting = false;
> data->T6_reportid = 0;
> data->T9_reportid_min = 0;
> data->T9_reportid_max = 0;
> @@ -849,6 +878,10 @@ static int mxt_initialize(struct mxt_data *data)
> if (error)
> goto err_free_object_table;
>
> + error = mxt_acquire_irq(data);
> + if (error)
> + goto err_free_object_table;
> +
> /* Check register init values */
> error = mxt_check_reg_init(data);
> if (error)
> @@ -886,6 +919,8 @@ static int mxt_initialize(struct mxt_data *data)
> info->matrix_xsize, info->matrix_ysize,
> info->object_num);
>
> + data->enable_reporting = true;
> +
> return 0;
>
> err_free_object_table:
> @@ -1087,11 +1122,7 @@ static ssize_t mxt_update_fw_store(struct device *dev,
> dev_dbg(dev, "The firmware update succeeded\n");
> mxt_free_object_table(data);
>
> - mxt_initialize(data);
> -
> - enable_irq(data->irq);
> -
> - error = mxt_make_highchg(data);
> + error = mxt_initialize(data);
> if (error)
> return error;
> }
> @@ -1188,9 +1219,19 @@ static int mxt_probe(struct i2c_client *client,
>
> mxt_calc_resolution(data);
>
> + error = request_threaded_irq(client->irq, NULL, mxt_interrupt,
> + pdata->irqflags | IRQF_ONESHOT,
> + client->name, data);
> + if (error) {
> + dev_err(&client->dev, "Failed to register interrupt\n");
> + goto err_free_mem;
> + }
> +
> + disable_irq(client->irq);
It is unclear what portion of the code should be executed with irqs
off. A better framing of the sensitive code path would be nice.
> +
> error = mxt_initialize(data);
> if (error)
> - goto err_free_mem;
> + goto err_free_irq;
>
> __set_bit(EV_ABS, input_dev->evbit);
> __set_bit(EV_KEY, input_dev->evbit);
> @@ -1241,21 +1282,9 @@ static int mxt_probe(struct i2c_client *client,
> input_set_drvdata(input_dev, data);
> i2c_set_clientdata(client, data);
>
> - error = request_threaded_irq(client->irq, NULL, mxt_interrupt,
> - pdata->irqflags | IRQF_ONESHOT,
> - client->name, data);
> - if (error) {
> - dev_err(&client->dev, "Failed to register interrupt\n");
> - goto err_free_object;
> - }
> -
> - error = mxt_make_highchg(data);
> - if (error)
> - goto err_free_irq;
> -
> error = input_register_device(input_dev);
> if (error)
> - goto err_free_irq;
> + goto err_free_object;
>
> error = sysfs_create_group(&client->dev.kobj, &mxt_attr_group);
> if (error)
> @@ -1266,10 +1295,10 @@ static int mxt_probe(struct i2c_client *client,
> err_unregister_device:
> input_unregister_device(input_dev);
> input_dev = NULL;
> -err_free_irq:
> - free_irq(client->irq, data);
> err_free_object:
> kfree(data->object_table);
> +err_free_irq:
> + free_irq(client->irq, data);
> err_free_mem:
> input_free_device(input_dev);
> kfree(data);
> --
> 1.7.10.4
>
Thanks,
Henrik
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists