linux-kernel - [PATCH v1] Input: touchscreen: ads7846.c: Fix race that causes missing releases

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20201026132117.20887-1-o.rempel@pengutronix.de>
Date:   Mon, 26 Oct 2020 14:21:17 +0100
From:   Oleksij Rempel <o.rempel@...gutronix.de>
To:     Dmitry Torokhov <dmitry.torokhov@...il.com>,
        Alexandru Ardelean <alexandru.ardelean@...log.com>
Cc:     David Jander <david@...tonic.nl>,
        Oleksij Rempel <o.rempel@...gutronix.de>,
        kernel@...gutronix.de, linux-kernel@...r.kernel.org,
        linux-input@...r.kernel.org
Subject: [PATCH v1] Input: touchscreen: ads7846.c: Fix race that causes missing releases

From: David Jander <david@...tonic.nl>

If touchscreen is released while busy reading HWMON device, the release
can be missed. The IRQ thread is not started because no touch is active
and BTN_TOUCH release event is never sent.

Fixes: f5a28a7d4858f94a ("Input: ads7846 - avoid pen up/down when reading hwmon")
Co-Developed-by: David Jander <david@...tonic.nl>
Signed-off-by: David Jander <david@...tonic.nl>
Signed-off-by: Oleksij Rempel <o.rempel@...gutronix.de>
---
 drivers/input/touchscreen/ads7846.c | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/drivers/input/touchscreen/ads7846.c b/drivers/input/touchscreen/ads7846.c
index ea31956f3a90..0236a119c52d 100644
--- a/drivers/input/touchscreen/ads7846.c
+++ b/drivers/input/touchscreen/ads7846.c
@@ -211,10 +211,26 @@ static void ads7846_stop(struct ads7846 *ts)
 	}
 }
 
+static int get_pendown_state(struct ads7846 *ts);
+
 /* Must be called with ts->lock held */
 static void ads7846_restart(struct ads7846 *ts)
 {
+	unsigned int pdstate;
+
 	if (!ts->disabled && !ts->suspended) {
+		/* Check if pen was released since last stop */
+		if (ts->pendown && !get_pendown_state(ts)) {
+			struct input_dev *input = ts->input;
+
+			input_report_key(input, BTN_TOUCH, 0);
+			input_report_abs(input, ABS_PRESSURE, 0);
+			input_sync(input);
+
+			ts->pendown = false;
+			dev_vdbg(&ts->spi->dev, "UP\n");
+		}
+
 		/* Tell IRQ thread that it may poll the device. */
 		ts->stopped = false;
 		mb();
-- 
2.28.0