user/sven/linux.git/drivers/input/misc/uinput.c, branch v4.4.265

Input: uinput - avoid FF flush when destroying device

2021-01-23T14:36:55Z

commit e8b95728f724797f958912fd9b765a695595d3a6 upstream. Normally, when input device supporting force feedback effects is being destroyed, we try to "flush" currently playing effects, so that the physical device does not continue vibrating (or executing other effects). Unfortunately this does not work well for uinput as flushing of the effects deadlocks with the destroy action: - if device is being destroyed because the file descriptor is being closed, then there is noone to even service FF requests; - if device is being destroyed because userspace sent UI_DEV_DESTROY, while theoretically it could be possible to service FF requests, userspace is unlikely to do so (they'd need to make sure FF handling happens on a separate thread) even if kernel solves the issue with FF ioctls deadlocking with UI_DEV_DESTROY ioctl on udev->mutex. To avoid lockups like the one below, let's install a custom input device flush handler, and avoid trying to flush force feedback effects when we destroying the device, and instead rely on uinput to shut off the device properly. NMI watchdog: Watchdog detected hard LOCKUP on cpu 3 ... <> [] _raw_spin_lock_irqsave+0x37/0x40 [] complete+0x1d/0x50 [] uinput_request_done+0x3c/0x40 [uinput] [] uinput_request_submit.part.7+0x47/0xb0 [uinput] [] uinput_dev_erase_effect+0x5b/0x76 [uinput] [] erase_effect+0xad/0xf0 [] flush_effects+0x4d/0x90 [] input_flush_device+0x40/0x60 [] evdev_cleanup+0xac/0xc0 [] evdev_disconnect+0x2b/0x60 [] __input_unregister_device+0xac/0x150 [] input_unregister_device+0x47/0x70 [] uinput_destroy_device+0xb5/0xc0 [uinput] [] uinput_ioctl_handler.isra.9+0x65e/0x740 [uinput] [] ? do_futex+0x12b/0xad0 [] uinput_ioctl+0x18/0x20 [uinput] [] do_vfs_ioctl+0x298/0x480 [] ? security_file_ioctl+0x43/0x60 [] SyS_ioctl+0x79/0x90 [] entry_SYSCALL_64_fastpath+0x12/0x71 Reported-by: Rodrigo Rivas Costa Reported-by: Clément VUCHENER Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=193741 Signed-off-by: Dmitry Torokhov Signed-off-by: Greg Kroah-Hartman

Input: uinput - add compat ioctl number translation for UI_*_FF_UPLOAD

2019-07-10T07:56:31Z

commit 7c7da40da1640ce6814dab1e8031b44e19e5a3f6 upstream. In the case of compat syscall ioctl numbers for UI_BEGIN_FF_UPLOAD and UI_END_FF_UPLOAD need to be adjusted before being passed on uinput_ioctl_handler() since code built with -m32 will be passing slightly different values. Extend the code already covering UI_SET_PHYS to cover UI_BEGIN_FF_UPLOAD and UI_END_FF_UPLOAD as well. Reported-by: Pierre-Loup A. Griffais Signed-off-by: Andrey Smirnov Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov Signed-off-by: Greg Kroah-Hartman

Input: uinput - handle compat ioctl for UI_SET_PHYS

2016-06-08T01:14:32Z

commit affa80bd97f7ca282d1faa91667b3ee9e4c590e6 upstream. When running a 32-bit userspace on a 64-bit kernel, the UI_SET_PHYS ioctl needs to be treated with special care, as it has the pointer size encoded in the command. Signed-off-by: Ricky Liang Signed-off-by: Dmitry Torokhov Signed-off-by: Greg Kroah-Hartman

Input: uinput - fix crash when using ABS events

2015-09-21T16:32:41Z

Commit b6d30968d86c45a7bb599eaca13ff048d3fa576c (Input: uinput - switch to using for_each_set_bit()) switched driver to use for_each_set_bit(). However during initial write of the uinput structure that contains min/max data for all possible axes none of them are reflected in dev->absbit yet and so we were skipping over all of them and were not allocating absinfo memory which caused crash later when driver tried to sens EV_ABS events: <1>[ 15.064330] BUG: unable to handle kernel NULL pointer dereference at 0000000000000024 <1>[ 15.064336] IP: [] input_handle_event+0x232/0x4e0 <4>[ 15.064343] PGD 0 <4>[ 15.064345] Oops: 0000 [#1] SMP Fixes: b6d30968d86c45a7bb599eaca13ff048d3fa576c Cc: stable@vger.kernel.org Reported-by: Stephen Chandler Paul Tested-by: Stephen Chandler Paul Signed-off-by: Dmitry Torokhov

Input: uinput - switch to using for_each_set_bit()

2015-07-09T18:19:25Z

Use for_each_set_bit to check for set bits in bitmap as it is more efficient and compact. Signed-off-by: Anshul Garg Signed-off-by: Dmitry Torokhov

Input: uinput - add UI_GET_VERSION ioctl

2014-07-21T21:30:42Z

This ioctl is the counterpart to EVIOCGVERSION and returns the uinput-version the kernel was compiled with. Reviewed-by: Peter Hutterer Signed-off-by: David Herrmann Signed-off-by: Dmitry Torokhov

Input: uinput - uinput_validate_absbits() cleanup

2014-07-21T21:28:21Z

This moves basic checks and setup from uinput_setup_device() into uinput_validate_absbits() to make it easier to use. This way, we can call it from other places without copying the boilerplate code. Reviewed-by: Peter Hutterer Signed-off-by: David Herrmann Signed-off-by: Dmitry Torokhov

Input: uinput - add UI_GET_SYSNAME ioctl to retrieve the sysfs path

2014-02-12T23:00:34Z

uinput is used in the xorg-integration-tests suite and in the wayland test suite. These automated tests suites create many virtual input devices and then hook something to read these newly created devices. Currently, uinput does not provide the created input device, which means that we rely on an heuristic to guess which input node was created. The problem is that is heuristic is subjected to races between different uinput devices or even with physical devices. Having a way to retrieve the sysfs path allows us to find without any doubts the event node. Signed-off-by: Benjamin Tissoires Reviewed-by: David Herrmann Signed-off-by: Dmitry Torokhov

Input: uinput - breaks by goto out in uinput_ioctl_handler

2014-01-31T01:30:57Z

The current implementation prevents us to add variable-length ioctl. Use a bunch of gotos instead of break to allow us to do so. No functional changes. Signed-off-by: Benjamin Tisssoires Reviewed-by: David Herrmann Signed-off-by: Dmitry Torokhov

Input: uinput - support injecting multiple events in one write() call

2013-09-19T15:57:56Z

Rework the code in uinput_inject_event so that it matches the code in evdev_write and allows injecting more than one event, or zero events. Signed-off-by: Ryan Mallon Signed-off-by: Dmitry Torokhov