1 files changed, 137 insertions, 53 deletions

diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c
index 9ddafc30f432..4cf25347b015 100644
--- a/drivers/input/evdev.c
+++ b/drivers/input/evdev.c
@@ -8,6 +8,8 @@
  * the Free Software Foundation.
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #define EVDEV_MINOR_BASE        64
 #define EVDEV_MINORS            32
 #define EVDEV_MIN_BUFFER_SIZE   64U
@@ -28,7 +30,7 @@ struct evdev {
         int minor;
         struct input_handle handle;
         wait_queue_head_t wait;
-        struct evdev_client *grab;
+        struct evdev_client __rcu *grab;
         struct list_head client_list;
         spinlock_t client_lock; /* protects client_list */
         struct mutex mutex;
@@ -37,13 +39,14 @@ struct evdev {
 };
 
 struct evdev_client {
-        int head;
-        int tail;
+        unsigned int head;
+        unsigned int tail;
+        unsigned int packet_head; /* [future] position of the first element of next packet */
         spinlock_t buffer_lock; /* protects access to buffer, head and tail */
         struct fasync_struct *fasync;
         struct evdev *evdev;
         struct list_head node;
-        int bufsize;
+        unsigned int bufsize;
         struct input_event buffer[];
 };
 
@@ -53,20 +56,33 @@ static DEFINE_MUTEX(evdev_table_mutex);
 static void evdev_pass_event(struct evdev_client *client,
                              struct input_event *event)
 {
-        /*
-         * Interrupts are disabled, just acquire the lock.
-         * Make sure we don't leave with the client buffer
-         * "empty" by having client->head == client->tail.
-         */
+        /* Interrupts are disabled, just acquire the lock. */
         spin_lock(&client->buffer_lock);
-        do {
-                client->buffer[client->head++] = *event;
-                client->head &= client->bufsize - 1;
-        } while (client->head == client->tail);
-        spin_unlock(&client->buffer_lock);
 
-        if (event->type == EV_SYN)
+        client->buffer[client->head++] = *event;
+        client->head &= client->bufsize - 1;
+
+        if (unlikely(client->head == client->tail)) {
+                /*
+                 * This effectively "drops" all unconsumed events, leaving
+                 * EV_SYN/SYN_DROPPED plus the newest event in the queue.
+                 */
+                client->tail = (client->head - 2) & (client->bufsize - 1);
+
+                client->buffer[client->tail].time = event->time;
+                client->buffer[client->tail].type = EV_SYN;
+                client->buffer[client->tail].code = SYN_DROPPED;
+                client->buffer[client->tail].value = 0;
+
+                client->packet_head = client->tail;
+        }
+
+        if (event->type == EV_SYN && event->code == SYN_REPORT) {
+                client->packet_head = client->head;
                 kill_fasync(&client->fasync, SIGIO, POLL_IN);
+        }
+
+        spin_unlock(&client->buffer_lock);
 }
 
 /*
@@ -95,7 +111,8 @@ static void evdev_event(struct input_handle *handle,
 
         rcu_read_unlock();
 
-        wake_up_interruptible(&evdev->wait);
+        if (type == EV_SYN && code == SYN_REPORT)
+                wake_up_interruptible(&evdev->wait);
 }
 
 static int evdev_fasync(int fd, struct file *file, int on)
@@ -148,7 +165,6 @@ static int evdev_grab(struct evdev *evdev, struct evdev_client *client)
                 return error;
 
         rcu_assign_pointer(evdev->grab, client);
-        synchronize_rcu();
 
         return 0;
 }
@@ -171,7 +187,6 @@ static void evdev_attach_client(struct evdev *evdev,
         spin_lock(&evdev->client_lock);
         list_add_tail_rcu(&client->node, &evdev->client_list);
         spin_unlock(&evdev->client_lock);
-        synchronize_rcu();
 }
 
 static void evdev_detach_client(struct evdev *evdev,
@@ -319,6 +334,9 @@ static ssize_t evdev_write(struct file *file, const char __user *buffer,
         struct input_event event;
         int retval;
 
+        if (count < input_event_size())
+                return -EINVAL;
+
         retval = mutex_lock_interruptible(&evdev->mutex);
         if (retval)
                 return retval;
@@ -328,17 +346,16 @@ static ssize_t evdev_write(struct file *file, const char __user *buffer,
                 goto out;
         }
 
-        while (retval < count) {
-
+        do {
                 if (input_event_from_user(buffer + retval, &event)) {
                         retval = -EFAULT;
                         goto out;
                 }
+                retval += input_event_size();
 
                 input_inject_event(&evdev->handle,
                                    event.type, event.code, event.value);
-                retval += input_event_size();
-        }
+        } while (retval + input_event_size() <= count);
 
  out:
         mutex_unlock(&evdev->mutex);
@@ -374,12 +391,12 @@ static ssize_t evdev_read(struct file *file, char __user *buffer,
         if (count < input_event_size())
                 return -EINVAL;
 
-        if (client->head == client->tail && evdev->exist &&
+        if (client->packet_head == client->tail && evdev->exist &&
             (file->f_flags & O_NONBLOCK))
                 return -EAGAIN;
 
         retval = wait_event_interruptible(evdev->wait,
-                client->head != client->tail || !evdev->exist);
+                client->packet_head != client->tail || !evdev->exist);
         if (retval)
                 return retval;
 
@@ -408,7 +425,7 @@ static unsigned int evdev_poll(struct file *file, poll_table *wait)
         poll_wait(file, &evdev->wait, wait);
 
         mask = evdev->exist ? POLLOUT | POLLWRNORM : POLLHUP | POLLERR;
-        if (client->head != client->tail)
+        if (client->packet_head != client->tail)
                 mask |= POLLIN | POLLRDNORM;
 
         return mask;
@@ -522,18 +539,88 @@ static int handle_eviocgbit(struct input_dev *dev,
         if (type == EV_KEY && size == OLD_KEY_MAX) {
                 len = OLD_KEY_MAX;
                 if (printk_timed_ratelimit(&keymax_warn_time, 10 * 1000))
-                        printk(KERN_WARNING
-                                "evdev.c(EVIOCGBIT): Suspicious buffer size %u, "
-                                "limiting output to %zu bytes. See "
-                                "http://userweb.kernel.org/~dtor/eviocgbit-bug.html\n",
-                                OLD_KEY_MAX,
-                                BITS_TO_LONGS(OLD_KEY_MAX) * sizeof(long));
+                        pr_warning("(EVIOCGBIT): Suspicious buffer size %u, "
+                                   "limiting output to %zu bytes. See "
+                                   "http://userweb.kernel.org/~dtor/eviocgbit-bug.html\n",
+                                   OLD_KEY_MAX,
+                                   BITS_TO_LONGS(OLD_KEY_MAX) * sizeof(long));
         }
 
         return bits_to_user(bits, len, size, p, compat_mode);
 }
 #undef OLD_KEY_MAX
 
+static int evdev_handle_get_keycode(struct input_dev *dev, void __user *p)
+{
+        struct input_keymap_entry ke = {
+                .len    = sizeof(unsigned int),
+                .flags  = 0,
+        };
+        int __user *ip = (int __user *)p;
+        int error;
+
+        /* legacy case */
+        if (copy_from_user(ke.scancode, p, sizeof(unsigned int)))
+                return -EFAULT;
+
+        error = input_get_keycode(dev, &ke);
+        if (error)
+                return error;
+
+        if (put_user(ke.keycode, ip + 1))
+                return -EFAULT;
+
+        return 0;
+}
+
+static int evdev_handle_get_keycode_v2(struct input_dev *dev, void __user *p)
+{
+        struct input_keymap_entry ke;
+        int error;
+
+        if (copy_from_user(&ke, p, sizeof(ke)))
+                return -EFAULT;
+
+        error = input_get_keycode(dev, &ke);
+        if (error)
+                return error;
+
+        if (copy_to_user(p, &ke, sizeof(ke)))
+                return -EFAULT;
+
+        return 0;
+}
+
+static int evdev_handle_set_keycode(struct input_dev *dev, void __user *p)
+{
+        struct input_keymap_entry ke = {
+                .len    = sizeof(unsigned int),
+                .flags  = 0,
+        };
+        int __user *ip = (int __user *)p;
+
+        if (copy_from_user(ke.scancode, p, sizeof(unsigned int)))
+                return -EFAULT;
+
+        if (get_user(ke.keycode, ip + 1))
+                return -EFAULT;
+
+        return input_set_keycode(dev, &ke);
+}
+
+static int evdev_handle_set_keycode_v2(struct input_dev *dev, void __user *p)
+{
+        struct input_keymap_entry ke;
+
+        if (copy_from_user(&ke, p, sizeof(ke)))
+                return -EFAULT;
+
+        if (ke.len > sizeof(ke.scancode))
+                return -EINVAL;
+
+        return input_set_keycode(dev, &ke);
+}
+
 static long evdev_do_ioctl(struct file *file, unsigned int cmd,
                            void __user *p, int compat_mode)
 {
@@ -580,25 +667,6 @@ static long evdev_do_ioctl(struct file *file, unsigned int cmd,
 
                 return 0;
 
-        case EVIOCGKEYCODE:
-                if (get_user(t, ip))
-                        return -EFAULT;
-
-                error = input_get_keycode(dev, t, &v);
-                if (error)
-                        return error;
-
-                if (put_user(v, ip + 1))
-                        return -EFAULT;
-
-                return 0;
-
-        case EVIOCSKEYCODE:
-                if (get_user(t, ip) || get_user(v, ip + 1))
-                        return -EFAULT;
-
-                return input_set_keycode(dev, t, v);
-
         case EVIOCRMFF:
                 return input_ff_erase(dev, (int)(unsigned long) p, file);
 
@@ -614,15 +682,30 @@ static long evdev_do_ioctl(struct file *file, unsigned int cmd,
                         return evdev_grab(evdev, client);
                 else
                         return evdev_ungrab(evdev, client);
+
+        case EVIOCGKEYCODE:
+                return evdev_handle_get_keycode(dev, p);
+
+        case EVIOCSKEYCODE:
+                return evdev_handle_set_keycode(dev, p);
+
+        case EVIOCGKEYCODE_V2:
+                return evdev_handle_get_keycode_v2(dev, p);
+
+        case EVIOCSKEYCODE_V2:
+                return evdev_handle_set_keycode_v2(dev, p);
         }
 
         size = _IOC_SIZE(cmd);
 
         /* Now check variable-length commands */
 #define EVIOC_MASK_SIZE(nr)     ((nr) & ~(_IOC_SIZEMASK << _IOC_SIZESHIFT))
-
         switch (EVIOC_MASK_SIZE(cmd)) {
 
+        case EVIOCGPROP(0):
+                return bits_to_user(dev->propbit, INPUT_PROP_MAX,
+                                    size, p, compat_mode);
+
         case EVIOCGKEY(0):
                 return bits_to_user(dev->key, KEY_MAX, size, p, compat_mode);
 
@@ -767,7 +850,8 @@ static const struct file_operations evdev_fops = {
         .compat_ioctl   = evdev_ioctl_compat,
 #endif
         .fasync         = evdev_fasync,
-        .flush          = evdev_flush
+        .flush          = evdev_flush,
+        .llseek         = no_llseek,
 };
 
 static int evdev_install_chrdev(struct evdev *evdev)
@@ -833,7 +917,7 @@ static int evdev_connect(struct input_handler *handler, struct input_dev *dev,
                         break;
 
         if (minor == EVDEV_MINORS) {
-                printk(KERN_ERR "evdev: no more free evdev devices\n");
+                pr_err("no more free evdev devices\n");
                 return -ENFILE;
         }