Date: Sun, 12 Mar 2017 19:27:44 +0000 (UTC) From: Oleksandr Tymoshenko <gonzo@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r315177 - head/sys/dev/evdev Message-ID: <201703121927.v2CJRitH015276@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: gonzo Date: Sun Mar 12 19:27:44 2017 New Revision: 315177 URL: https://svnweb.freebsd.org/changeset/base/315177 Log: [evdev] Fix race condition between client's event queue reading and dropping Submitted by: Vladimir Kondratiev <wulf@cicgroup.ru> MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D9320 Modified: head/sys/dev/evdev/cdev.c Modified: head/sys/dev/evdev/cdev.c ============================================================================== --- head/sys/dev/evdev/cdev.c Sun Mar 12 19:26:24 2017 (r315176) +++ head/sys/dev/evdev/cdev.c Sun Mar 12 19:27:44 2017 (r315177) @@ -162,7 +162,7 @@ static int evdev_read(struct cdev *dev, struct uio *uio, int ioflag) { struct evdev_client *client; - struct input_event *event; + struct input_event event; int ret = 0; int remaining; @@ -197,13 +197,14 @@ evdev_read(struct cdev *dev, struct uio } while (ret == 0 && !EVDEV_CLIENT_EMPTYQ(client) && remaining > 0) { - event = &client->ec_buffer[client->ec_buffer_head]; + memcpy(&event, &client->ec_buffer[client->ec_buffer_head], + sizeof(struct input_event)); client->ec_buffer_head = (client->ec_buffer_head + 1) % client->ec_buffer_size; remaining--; EVDEV_CLIENT_UNLOCKQ(client); - ret = uiomove(event, sizeof(struct input_event), uio); + ret = uiomove(&event, sizeof(struct input_event), uio); EVDEV_CLIENT_LOCKQ(client); }
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201703121927.v2CJRitH015276>