1 files changed, 42 insertions, 12 deletions

diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c
index 2ee6c7a68bdc..054edf346e0b 100644
--- a/drivers/input/evdev.c
+++ b/drivers/input/evdev.c
@@ -10,7 +10,8 @@
 
 #define EVDEV_MINOR_BASE        64
 #define EVDEV_MINORS            32
-#define EVDEV_BUFFER_SIZE       64
+#define EVDEV_MIN_BUFFER_SIZE   64U
+#define EVDEV_BUF_PACKETS       8
 
 #include <linux/poll.h>
 #include <linux/sched.h>
@@ -23,7 +24,6 @@
 #include "input-compat.h"
 
 struct evdev {
-        int exist;
         int open;
         int minor;
         struct input_handle handle;
@@ -33,16 +33,18 @@ struct evdev {
         spinlock_t client_lock; /* protects client_list */
         struct mutex mutex;
         struct device dev;
+        bool exist;
 };
 
 struct evdev_client {
-        struct input_event buffer[EVDEV_BUFFER_SIZE];
         int head;
         int tail;
         spinlock_t buffer_lock; /* protects access to buffer, head and tail */
         struct fasync_struct *fasync;
         struct evdev *evdev;
         struct list_head node;
+        int bufsize;
+        struct input_event buffer[];
 };
 
 static struct evdev *evdev_table[EVDEV_MINORS];
@@ -52,11 +54,15 @@ static void evdev_pass_event(struct evdev_client *client,
                              struct input_event *event)
 {
         /*
-         * Interrupts are disabled, just acquire the lock
+         * Interrupts are disabled, just acquire the lock.
+         * Make sure we don't leave with the client buffer
+         * "empty" by having client->head == client->tail.
          */
         spin_lock(&client->buffer_lock);
-        client->buffer[client->head++] = *event;
-        client->head &= EVDEV_BUFFER_SIZE - 1;
+        do {
+                client->buffer[client->head++] = *event;
+                client->head &= client->bufsize - 1;
+        } while (client->head == client->tail);
         spin_unlock(&client->buffer_lock);
 
         if (event->type == EV_SYN)
@@ -242,11 +248,21 @@ static int evdev_release(struct inode *inode, struct file *file)
         return 0;
 }
 
+static unsigned int evdev_compute_buffer_size(struct input_dev *dev)
+{
+        unsigned int n_events =
+                max(dev->hint_events_per_packet * EVDEV_BUF_PACKETS,
+                    EVDEV_MIN_BUFFER_SIZE);
+
+        return roundup_pow_of_two(n_events);
+}
+
 static int evdev_open(struct inode *inode, struct file *file)
 {
         struct evdev *evdev;
         struct evdev_client *client;
         int i = iminor(inode) - EVDEV_MINOR_BASE;
+        unsigned int bufsize;
         int error;
 
         if (i >= EVDEV_MINORS)
@@ -263,12 +279,17 @@ static int evdev_open(struct inode *inode, struct file *file)
         if (!evdev)
                 return -ENODEV;
 
-        client = kzalloc(sizeof(struct evdev_client), GFP_KERNEL);
+        bufsize = evdev_compute_buffer_size(evdev->handle.dev);
+
+        client = kzalloc(sizeof(struct evdev_client) +
+                                bufsize * sizeof(struct input_event),
+                         GFP_KERNEL);
         if (!client) {
                 error = -ENOMEM;
                 goto err_put_evdev;
         }
 
+        client->bufsize = bufsize;
         spin_lock_init(&client->buffer_lock);
         client->evdev = evdev;
         evdev_attach_client(evdev, client);
@@ -334,7 +355,7 @@ static int evdev_fetch_next_event(struct evdev_client *client,
         have_event = client->head != client->tail;
         if (have_event) {
                 *event = client->buffer[client->tail++];
-                client->tail &= EVDEV_BUFFER_SIZE - 1;
+                client->tail &= client->bufsize - 1;
         }
 
         spin_unlock_irq(&client->buffer_lock);
@@ -382,10 +403,15 @@ static unsigned int evdev_poll(struct file *file, poll_table *wait)
 {
         struct evdev_client *client = file->private_data;
         struct evdev *evdev = client->evdev;
+        unsigned int mask;
 
         poll_wait(file, &evdev->wait, wait);
-        return ((client->head == client->tail) ? 0 : (POLLIN | POLLRDNORM)) |
-                (evdev->exist ? 0 : (POLLHUP | POLLERR));
+
+        mask = evdev->exist ? POLLOUT | POLLWRNORM : POLLHUP | POLLERR;
+        if (client->head != client->tail)
+                mask |= POLLIN | POLLRDNORM;
+
+        return mask;
 }
 
 #ifdef CONFIG_COMPAT
@@ -665,6 +691,10 @@ static long evdev_do_ioctl(struct file *file, unsigned int cmd,
                                                                   sizeof(struct input_absinfo))))
                                         return -EFAULT;
 
+                                /* We can't change number of reserved MT slots */
+                                if (t == ABS_MT_SLOT)
+                                        return -EINVAL;
+
                                 /*
                                  * Take event lock to ensure that we are not
                                  * changing device parameters in the middle
@@ -768,7 +798,7 @@ static void evdev_remove_chrdev(struct evdev *evdev)
 static void evdev_mark_dead(struct evdev *evdev)
 {
         mutex_lock(&evdev->mutex);
-        evdev->exist = 0;
+        evdev->exist = false;
         mutex_unlock(&evdev->mutex);
 }
 
@@ -817,7 +847,7 @@ static int evdev_connect(struct input_handler *handler, struct input_dev *dev,
         init_waitqueue_head(&evdev->wait);
 
         dev_set_name(&evdev->dev, "event%d", minor);
-        evdev->exist = 1;
+        evdev->exist = true;
         evdev->minor = minor;
 
         evdev->handle.dev = input_get_device(dev);