Input: keyboard - fix lack of locking when traversing handler->h_list

Keyboard handler should not attempt to traverse handler->h_list on
its own, without any locking, otherwise it races with registering
and unregistering of input handles which leads to crashes.

Introduce input_handler_for_each_handle() helper that allows safely
iterate over all handles attached to a particular handler and switch
keyboard handler to use it.

Reported-by: Jim Paradis <jparadis@redhat.com>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>

1 files changed, 8 insertions, 2 deletions

diff --git a/include/linux/input.h b/include/linux/input.h
index 56d8e048c646..db563bbac9dd 100644
--- a/include/linux/input.h
+++ b/include/linux/input.h
@@ -1021,9 +1021,12 @@ struct ff_effect {
  * @keycodesize: size of elements in keycode table
  * @keycode: map of scancodes to keycodes for this device
  * @setkeycode: optional method to alter current keymap, used to implement
- *      sparse keymaps. If not supplied default mechanism will be used
+ *      sparse keymaps. If not supplied default mechanism will be used.
+ *      The method is being called while holding event_lock and thus must
+ *      not sleep
  * @getkeycode: optional method to retrieve current keymap. If not supplied
- *      default mechanism will be used
+ *      default mechanism will be used. The method is being called while
+ *      holding event_lock and thus must not sleep
  * @ff: force feedback structure associated with the device if device
  *      supports force feedback effects
  * @repeat_key: stores key code of the last key pressed; used to implement
@@ -1295,6 +1298,9 @@ void input_unregister_device(struct input_dev *);
 int __must_check input_register_handler(struct input_handler *);
 void input_unregister_handler(struct input_handler *);
 
+int input_handler_for_each_handle(struct input_handler *, void *data,
+                                  int (*fn)(struct input_handle *, void *));
+
 int input_register_handle(struct input_handle *);
 void input_unregister_handle(struct input_handle *);