| Message ID | 1379458544-6508-2-git-send-email-rmallon@gmail.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
Hi Ryan, On Wed, Sep 18, 2013 at 08:55:44AM +1000, Ryan Mallon wrote: > Rework the code in uinput_inject_event so that it matches the code in > evdev_write and allows injecting more than one event, or zero events. After some thinking I went back to the original version of your patch. For justification see 46f49b7a223ac7493e7cf619fb583d11edefc2c2: "When copy_to/from_user fails in the middle of transfer we should not report to the user that read/write partially succeeded but rather report -EFAULT right away, so that application will know that it got its buffers all wrong. If application messed up its buffers we can't trust the data fetched from userspace and successfully written to the device or if data read from the device and transferred to userspace ended up where application expected it to end." Thanks.
On 19/09/13 05:48, Dmitry Torokhov wrote: > Hi Ryan, > > On Wed, Sep 18, 2013 at 08:55:44AM +1000, Ryan Mallon wrote: >> Rework the code in uinput_inject_event so that it matches the code in >> evdev_write and allows injecting more than one event, or zero events. > > After some thinking I went back to the original version of your patch. > For justification see 46f49b7a223ac7493e7cf619fb583d11edefc2c2: > > "When copy_to/from_user fails in the middle of transfer we should not > report to the user that read/write partially succeeded but rather > report -EFAULT right away, so that application will know that it got > its buffers all wrong. > > If application messed up its buffers we can't trust the data fetched > from userspace and successfully written to the device or if data read > from the device and transferred to userspace ended up where application > expected it to end." Okay, so patch 1 is obviously dropped. Do you want me to resend a fixed version of this one, or have you already modified it? Thanks, ~Ryan -- To unsubscribe from this list: send the line "unsubscribe linux-input" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Ryan Mallon <rmallon@gmail.com> wrote: >On 19/09/13 05:48, Dmitry Torokhov wrote: > >> Hi Ryan, >> >> On Wed, Sep 18, 2013 at 08:55:44AM +1000, Ryan Mallon wrote: >>> Rework the code in uinput_inject_event so that it matches the code >in >>> evdev_write and allows injecting more than one event, or zero >events. >> >> After some thinking I went back to the original version of your >patch. >> For justification see 46f49b7a223ac7493e7cf619fb583d11edefc2c2: >> >> "When copy_to/from_user fails in the middle of transfer we should not >> report to the user that read/write partially succeeded but rather >> report -EFAULT right away, so that application will know that it got >> its buffers all wrong. >> >> If application messed up its buffers we can't trust the data fetched >> from userspace and successfully written to the device or if data read >> from the device and transferred to userspace ended up where >application >> expected it to end." > > >Okay, so patch 1 is obviously dropped. Do you want me to resend a fixed > >version of this one, or have you already modified it? I took your original version - is does the right thing. Thanks.
diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c index a0a4bba..0247a8a 100644 --- a/drivers/input/misc/uinput.c +++ b/drivers/input/misc/uinput.c @@ -434,16 +434,24 @@ static ssize_t uinput_inject_event(struct uinput_device *udev, const char __user *buffer, size_t count) { struct input_event ev; + size_t bytes = 0; - if (count < input_event_size()) + if (count != 0 && count < input_event_size()) return -EINVAL; - if (input_event_from_user(buffer, &ev)) - return -EFAULT; + while (bytes + input_event_size() <= count) { + if (input_event_from_user(buffer + bytes, &ev)) { + if (!bytes) + bytes = -EFAULT; + goto out; + } - input_event(udev->dev, ev.type, ev.code, ev.value); + input_event(udev->dev, ev.type, ev.code, ev.value); + bytes += input_event_size(); + } - return input_event_size(); + out: + return bytes; } static ssize_t uinput_write(struct file *file, const char __user *buffer,
Rework the code in uinput_inject_event so that it matches the code in evdev_write and allows injecting more than one event, or zero events. Signed-off-by: Ryan Mallon <rmallon@gmail.com> --- drivers/input/misc/uinput.c | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-)