1. 08 12月, 2010 1 次提交
  2. 07 12月, 2010 2 次提交
    • V
      HID: Consolidate device existence checks in hiddev_ioctl · 33d6eb57
      Valentine Barshak 提交于
      Currently, if the device has been removed before hiddev_ioctl(),
      the -EIO is returned. If it's removed while hiddev_ioctl() is in
      progress, some commands are still processed fine, others
      return -ENODEV. This change takes the "existancelock" before
      processing ioctl commands and releases it at the end.
      If the device has been removed, always returns -ENODEV.
      Signed-off-by: NValentine Barshak <vbarshak@mvista.com>
      Signed-off-by: NJiri Kosina <jkosina@suse.cz>
      33d6eb57
    • V
      HID: Fix race between disconnect and hiddev_ioctl · 1a8e8fab
      Valentine Barshak 提交于
      A USB HID device can be disconnected at any time.
      If this happens right before or while hiddev_ioctl is in progress,
      the hiddev_ioctl tries to access invalid hiddev->hid pointer.
      When the hid device is disconnected, the hiddev_disconnect()
      ends up with a call to hid_device_release() which frees
      hid_device, but doesn't set the hiddev->hid pointer to NULL.
      If the deallocated memory region has been re-used by the kernel,
      this can cause a crash or memory corruption.
      
      Since disconnect can happen at any time, we can't initialize
      struct hid_device *hid = hiddev->hid at the beginning of ioctl
      and then use it.
      
      This change checks hiddev->exist flag while holding
      the existancelock and uses hid_device only if it exists.
      Signed-off-by: NValentine Barshak <vbarshak@mvista.com>
      Signed-off-by: NJiri Kosina <jkosina@suse.cz>
      1a8e8fab
  3. 28 11月, 2010 1 次提交
  4. 25 11月, 2010 1 次提交
  5. 18 11月, 2010 4 次提交
  6. 15 11月, 2010 1 次提交
  7. 03 11月, 2010 2 次提交
  8. 02 11月, 2010 1 次提交
  9. 25 10月, 2010 11 次提交
  10. 24 10月, 2010 3 次提交
  11. 23 10月, 2010 13 次提交