Input: psmouse - fix data race in __ps2_command
authorDmitry Vyukov <dvyukov@google.com>
Tue, 29 Sep 2015 22:54:58 +0000 (15:54 -0700)
committerDmitry Torokhov <dmitry.torokhov@gmail.com>
Tue, 29 Sep 2015 23:08:29 +0000 (16:08 -0700)
commit218c1f76b8b25d6dc9d01443f071cb618e206b0c
treeecd48ba4dadb9da65b5ccb3cb86afc8f692b1fdd
parent22ef28b43f2c70edf5618918a49cbda84795c0a5
Input: psmouse - fix data race in __ps2_command

The data race happens on ps2dev->cmdcnt and ps2dev->cmdbuf contents.
__ps2_command reads that data concurrently with the interrupt handler. As
the result, for example, if a response arrives just after the timeout,
__ps2_command can copy out garbage from ps2dev->cmdbuf but then see that
ps2dev->cmdcnt is 0 and return success.

Stop the interrupt handler with serio_pause_rx() before reading the
results.

The data race was found with KernelThreadSanitizer (KTSAN).

Signed-off-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
drivers/input/serio/libps2.c