From patchwork Sun May 22 18:22:23 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Manuel Reimer X-Patchwork-Id: 9130995 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 1346C60459 for ; Sun, 22 May 2016 18:22:32 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id DBFC4281AB for ; Sun, 22 May 2016 18:22:31 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id CF230281C1; Sun, 22 May 2016 18:22:31 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 9164E281AB for ; Sun, 22 May 2016 18:22:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752443AbcEVSW3 (ORCPT ); Sun, 22 May 2016 14:22:29 -0400 Received: from mx1.mailbox.org ([80.241.60.212]:40673 "EHLO mx1.mailbox.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752297AbcEVSW3 (ORCPT ); Sun, 22 May 2016 14:22:29 -0400 Received: from smtp1.mailbox.org (smtp1.mailbox.org [80.241.60.240]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.mailbox.org (Postfix) with ESMTPS id 2EDC8417B6; Sun, 22 May 2016 20:22:26 +0200 (CEST) X-Virus-Scanned: amavisd-new at heinlein-support.de Received: from smtp1.mailbox.org ([80.241.60.240]) by hefe.heinlein-support.de (hefe.heinlein-support.de [91.198.250.172]) (amavisd-new, port 10030) with ESMTP id VHgMtVd4iCcp; Sun, 22 May 2016 20:22:25 +0200 (CEST) To: linux-input , dmitry.torokhov@gmail.com From: Manuel Reimer Subject: [PATCH] uinput: Fix module crash on driver exit with force feedback effects still loaded Message-ID: Date: Sun, 22 May 2016 20:22:23 +0200 MIME-Version: 1.0 Sender: linux-input-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-input@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Hello, I had a deeper look into the uinput kernel module crash problem, which happens when a game loads effects and the driver exits while the game is still running. The actual problem is, that "input_unregister_device", which is called in "uinput_destroy_device", seems to include some "cleanup routine" which includes erasing loaded force feedback effects. This cleanup routine causes the "uinput_dev_erase_effect" routine to be called, which will wait for the, already exited, daemon to answer this request. The existing code contains a device state test, but this test is placed wrong. My patch moves the device state test, which was in "uinput_request_send", to the "uinput_request_submit" function. This way the erase requests, triggered by "input_unregister_device", are rejected immediately, so they no longer cause any trouble. Should I have added a one-line comment above the device state test, mentioning the cleanup routine in "input_unregister_device"? Signed-off-by: Manuel Reimer --- To unsubscribe from this list: send the line "unsubscribe linux-input" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html --- a/drivers/input/misc/uinput.c 2016-05-13 16:06:31.919351656 +0200 +++ b/drivers/input/misc/uinput.c 2016-05-22 19:33:30.814403482 +0200 @@ -117,11 +117,6 @@ static int uinput_request_send(struct ui if (retval) return retval; - if (udev->state != UIST_CREATED) { - retval = -ENODEV; - goto out; - } - init_completion(&request->done); /* @@ -130,7 +125,6 @@ static int uinput_request_send(struct ui */ uinput_dev_event(udev->dev, EV_UINPUT, request->code, request->id); - out: mutex_unlock(&udev->mutex); return retval; } @@ -140,6 +134,9 @@ static int uinput_request_submit(struct { int error; + if (udev->state != UIST_CREATED) + return -ENODEV; + error = uinput_request_reserve_slot(udev, request); if (error) return error;