1. 08 Dec, 2010 1 commit
  2. 07 Dec, 2010 2 commits
    • Valentine Barshak's avatar
      HID: Consolidate device existence checks in hiddev_ioctl · 33d6eb57
      Valentine Barshak authored
      Currently, if the device has been removed before hiddev_ioctl(),
      the -EIO is returned. If it's removed while hiddev_ioctl() is in
      progress, some commands are still processed fine, others
      return -ENODEV. This change takes the "existancelock" before
      processing ioctl commands and releases it at the end.
      If the device has been removed, always returns -ENODEV.
      Signed-off-by: default avatarValentine Barshak <vbarshak@mvista.com>
      Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
      33d6eb57
    • Valentine Barshak's avatar
      HID: Fix race between disconnect and hiddev_ioctl · 1a8e8fab
      Valentine Barshak authored
      A USB HID device can be disconnected at any time.
      If this happens right before or while hiddev_ioctl is in progress,
      the hiddev_ioctl tries to access invalid hiddev->hid pointer.
      When the hid device is disconnected, the hiddev_disconnect()
      ends up with a call to hid_device_release() which frees
      hid_device, but doesn't set the hiddev->hid pointer to NULL.
      If the deallocated memory region has been re-used by the kernel,
      this can cause a crash or memory corruption.
      
      Since disconnect can happen at any time, we can't initialize
      struct hid_device *hid = hiddev->hid at the beginning of ioctl
      and then use it.
      
      This change checks hiddev->exist flag while holding
      the existancelock and uses hid_device only if it exists.
      Signed-off-by: default avatarValentine Barshak <vbarshak@mvista.com>
      Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
      1a8e8fab
  3. 28 Nov, 2010 1 commit
  4. 25 Nov, 2010 1 commit
  5. 18 Nov, 2010 4 commits
  6. 15 Nov, 2010 1 commit
  7. 03 Nov, 2010 2 commits
  8. 01 Nov, 2010 1 commit
  9. 24 Oct, 2010 27 commits