mirror of
https://github.com/torvalds/linux.git
synced 2025-12-07 20:06:24 +00:00
The following warning appears when running syzkaller, and this issue also
exists in the mainline code.
------------[ cut here ]------------
list_add double add: new=ffffffffa57eee28, prev=ffffffffa57eee28, next=ffffffffa5e63100.
WARNING: CPU: 0 PID: 1491 at lib/list_debug.c:35 __list_add_valid_or_report+0xf7/0x130
Modules linked in:
CPU: 0 PID: 1491 Comm: syz.1.28 Not tainted 6.6.0+ #3
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
RIP: 0010:__list_add_valid_or_report+0xf7/0x130
RSP: 0018:ff1100010dfb7b78 EFLAGS: 00010282
RAX: 0000000000000000 RBX: ffffffffa57eee18 RCX: ffffffff97fc9817
RDX: 0000000000040000 RSI: ffa0000002383000 RDI: 0000000000000001
RBP: ffffffffa57eee28 R08: 0000000000000001 R09: ffe21c0021bf6f2c
R10: 0000000000000001 R11: 6464615f7473696c R12: ffffffffa5e63100
R13: ffffffffa57eee28 R14: ffffffffa57eee28 R15: ff1100010dfb7d48
FS: 00007fb14398b640(0000) GS:ff11000119600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 000000010d096005 CR4: 0000000000773ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 80000000
Call Trace:
<TASK>
input_register_handler+0xb3/0x210
mac_hid_start_emulation+0x1c5/0x290
mac_hid_toggle_emumouse+0x20a/0x240
proc_sys_call_handler+0x4c2/0x6e0
new_sync_write+0x1b1/0x2d0
vfs_write+0x709/0x950
ksys_write+0x12a/0x250
do_syscall_64+0x5a/0x110
entry_SYSCALL_64_after_hwframe+0x78/0xe2
The WARNING occurs when two processes concurrently write to the mac-hid
emulation sysctl, causing a race condition in mac_hid_toggle_emumouse().
Both processes read old_val=0, then both try to register the input handler,
leading to a double list_add of the same handler.
CPU0 CPU1
------------------------- -------------------------
vfs_write() //write 1 vfs_write() //write 1
proc_sys_write() proc_sys_write()
mac_hid_toggle_emumouse() mac_hid_toggle_emumouse()
old_val = *valp // old_val=0
old_val = *valp // old_val=0
mutex_lock_killable()
proc_dointvec() // *valp=1
mac_hid_start_emulation()
input_register_handler()
mutex_unlock()
mutex_lock_killable()
proc_dointvec()
mac_hid_start_emulation()
input_register_handler() //Trigger Warning
mutex_unlock()
Fix this by moving the old_val read inside the mutex lock region.
Fixes: 99b089c3c3 ("Input: Mac button emulation - implement as an input filter")
Signed-off-by: Long Li <leo.lilong@huawei.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20250819091035.2263329-1-leo.lilong@huaweicloud.com
263 lines
5.8 KiB
C
263 lines
5.8 KiB
C
// SPDX-License-Identifier: GPL-2.0-only
|
|
/*
|
|
* drivers/macintosh/mac_hid.c
|
|
*
|
|
* HID support stuff for Macintosh computers.
|
|
*
|
|
* Copyright (C) 2000 Franz Sirl.
|
|
*
|
|
* This file will soon be removed in favor of an uinput userspace tool.
|
|
*/
|
|
|
|
#include <linux/init.h>
|
|
#include <linux/proc_fs.h>
|
|
#include <linux/sysctl.h>
|
|
#include <linux/input.h>
|
|
#include <linux/module.h>
|
|
#include <linux/slab.h>
|
|
|
|
MODULE_DESCRIPTION("Mouse button 2+3 emulation");
|
|
MODULE_LICENSE("GPL");
|
|
|
|
static int mouse_emulate_buttons;
|
|
static int mouse_button2_keycode = KEY_RIGHTCTRL; /* right control key */
|
|
static int mouse_button3_keycode = KEY_RIGHTALT; /* right option key */
|
|
|
|
static struct input_dev *mac_hid_emumouse_dev;
|
|
|
|
static DEFINE_MUTEX(mac_hid_emumouse_mutex);
|
|
|
|
static int mac_hid_create_emumouse(void)
|
|
{
|
|
static struct lock_class_key mac_hid_emumouse_dev_event_class;
|
|
static struct lock_class_key mac_hid_emumouse_dev_mutex_class;
|
|
int err;
|
|
|
|
mac_hid_emumouse_dev = input_allocate_device();
|
|
if (!mac_hid_emumouse_dev)
|
|
return -ENOMEM;
|
|
|
|
lockdep_set_class(&mac_hid_emumouse_dev->event_lock,
|
|
&mac_hid_emumouse_dev_event_class);
|
|
lockdep_set_class(&mac_hid_emumouse_dev->mutex,
|
|
&mac_hid_emumouse_dev_mutex_class);
|
|
|
|
mac_hid_emumouse_dev->name = "Macintosh mouse button emulation";
|
|
mac_hid_emumouse_dev->id.bustype = BUS_ADB;
|
|
mac_hid_emumouse_dev->id.vendor = 0x0001;
|
|
mac_hid_emumouse_dev->id.product = 0x0001;
|
|
mac_hid_emumouse_dev->id.version = 0x0100;
|
|
|
|
mac_hid_emumouse_dev->evbit[0] = BIT_MASK(EV_KEY) | BIT_MASK(EV_REL);
|
|
mac_hid_emumouse_dev->keybit[BIT_WORD(BTN_MOUSE)] =
|
|
BIT_MASK(BTN_LEFT) | BIT_MASK(BTN_MIDDLE) | BIT_MASK(BTN_RIGHT);
|
|
mac_hid_emumouse_dev->relbit[0] = BIT_MASK(REL_X) | BIT_MASK(REL_Y);
|
|
|
|
err = input_register_device(mac_hid_emumouse_dev);
|
|
if (err) {
|
|
input_free_device(mac_hid_emumouse_dev);
|
|
mac_hid_emumouse_dev = NULL;
|
|
return err;
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
static void mac_hid_destroy_emumouse(void)
|
|
{
|
|
input_unregister_device(mac_hid_emumouse_dev);
|
|
mac_hid_emumouse_dev = NULL;
|
|
}
|
|
|
|
static bool mac_hid_emumouse_filter(struct input_handle *handle,
|
|
unsigned int type, unsigned int code,
|
|
int value)
|
|
{
|
|
unsigned int btn;
|
|
|
|
if (type != EV_KEY)
|
|
return false;
|
|
|
|
if (code == mouse_button2_keycode)
|
|
btn = BTN_MIDDLE;
|
|
else if (code == mouse_button3_keycode)
|
|
btn = BTN_RIGHT;
|
|
else
|
|
return false;
|
|
|
|
input_report_key(mac_hid_emumouse_dev, btn, value);
|
|
input_sync(mac_hid_emumouse_dev);
|
|
|
|
return true;
|
|
}
|
|
|
|
static int mac_hid_emumouse_connect(struct input_handler *handler,
|
|
struct input_dev *dev,
|
|
const struct input_device_id *id)
|
|
{
|
|
struct input_handle *handle;
|
|
int error;
|
|
|
|
/* Don't bind to ourselves */
|
|
if (dev == mac_hid_emumouse_dev)
|
|
return -ENODEV;
|
|
|
|
handle = kzalloc(sizeof(struct input_handle), GFP_KERNEL);
|
|
if (!handle)
|
|
return -ENOMEM;
|
|
|
|
handle->dev = dev;
|
|
handle->handler = handler;
|
|
handle->name = "mac-button-emul";
|
|
|
|
error = input_register_handle(handle);
|
|
if (error) {
|
|
printk(KERN_ERR
|
|
"mac_hid: Failed to register button emulation handle, "
|
|
"error %d\n", error);
|
|
goto err_free;
|
|
}
|
|
|
|
error = input_open_device(handle);
|
|
if (error) {
|
|
printk(KERN_ERR
|
|
"mac_hid: Failed to open input device, error %d\n",
|
|
error);
|
|
goto err_unregister;
|
|
}
|
|
|
|
return 0;
|
|
|
|
err_unregister:
|
|
input_unregister_handle(handle);
|
|
err_free:
|
|
kfree(handle);
|
|
return error;
|
|
}
|
|
|
|
static void mac_hid_emumouse_disconnect(struct input_handle *handle)
|
|
{
|
|
input_close_device(handle);
|
|
input_unregister_handle(handle);
|
|
kfree(handle);
|
|
}
|
|
|
|
static const struct input_device_id mac_hid_emumouse_ids[] = {
|
|
{
|
|
.flags = INPUT_DEVICE_ID_MATCH_EVBIT,
|
|
.evbit = { BIT_MASK(EV_KEY) },
|
|
},
|
|
{ },
|
|
};
|
|
|
|
MODULE_DEVICE_TABLE(input, mac_hid_emumouse_ids);
|
|
|
|
static struct input_handler mac_hid_emumouse_handler = {
|
|
.filter = mac_hid_emumouse_filter,
|
|
.connect = mac_hid_emumouse_connect,
|
|
.disconnect = mac_hid_emumouse_disconnect,
|
|
.name = "mac-button-emul",
|
|
.id_table = mac_hid_emumouse_ids,
|
|
};
|
|
|
|
static int mac_hid_start_emulation(void)
|
|
{
|
|
int err;
|
|
|
|
err = mac_hid_create_emumouse();
|
|
if (err)
|
|
return err;
|
|
|
|
err = input_register_handler(&mac_hid_emumouse_handler);
|
|
if (err) {
|
|
mac_hid_destroy_emumouse();
|
|
return err;
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
static void mac_hid_stop_emulation(void)
|
|
{
|
|
input_unregister_handler(&mac_hid_emumouse_handler);
|
|
mac_hid_destroy_emumouse();
|
|
}
|
|
|
|
static int mac_hid_toggle_emumouse(const struct ctl_table *table, int write,
|
|
void *buffer, size_t *lenp, loff_t *ppos)
|
|
{
|
|
int *valp = table->data;
|
|
int old_val;
|
|
int rc;
|
|
|
|
rc = mutex_lock_killable(&mac_hid_emumouse_mutex);
|
|
if (rc)
|
|
return rc;
|
|
|
|
old_val = *valp;
|
|
rc = proc_dointvec(table, write, buffer, lenp, ppos);
|
|
|
|
if (rc == 0 && write && *valp != old_val) {
|
|
if (*valp == 1)
|
|
rc = mac_hid_start_emulation();
|
|
else if (*valp == 0)
|
|
mac_hid_stop_emulation();
|
|
else
|
|
rc = -EINVAL;
|
|
}
|
|
|
|
/* Restore the old value in case of error */
|
|
if (rc)
|
|
*valp = old_val;
|
|
|
|
mutex_unlock(&mac_hid_emumouse_mutex);
|
|
|
|
return rc;
|
|
}
|
|
|
|
/* file(s) in /proc/sys/dev/mac_hid */
|
|
static const struct ctl_table mac_hid_files[] = {
|
|
{
|
|
.procname = "mouse_button_emulation",
|
|
.data = &mouse_emulate_buttons,
|
|
.maxlen = sizeof(int),
|
|
.mode = 0644,
|
|
.proc_handler = mac_hid_toggle_emumouse,
|
|
},
|
|
{
|
|
.procname = "mouse_button2_keycode",
|
|
.data = &mouse_button2_keycode,
|
|
.maxlen = sizeof(int),
|
|
.mode = 0644,
|
|
.proc_handler = proc_dointvec,
|
|
},
|
|
{
|
|
.procname = "mouse_button3_keycode",
|
|
.data = &mouse_button3_keycode,
|
|
.maxlen = sizeof(int),
|
|
.mode = 0644,
|
|
.proc_handler = proc_dointvec,
|
|
},
|
|
};
|
|
|
|
static struct ctl_table_header *mac_hid_sysctl_header;
|
|
|
|
static int __init mac_hid_init(void)
|
|
{
|
|
mac_hid_sysctl_header = register_sysctl("dev/mac_hid", mac_hid_files);
|
|
if (!mac_hid_sysctl_header)
|
|
return -ENOMEM;
|
|
|
|
return 0;
|
|
}
|
|
module_init(mac_hid_init);
|
|
|
|
static void __exit mac_hid_exit(void)
|
|
{
|
|
unregister_sysctl_table(mac_hid_sysctl_header);
|
|
|
|
if (mouse_emulate_buttons)
|
|
mac_hid_stop_emulation();
|
|
}
|
|
module_exit(mac_hid_exit);
|