diff options
| author | Dmitry Vyukov <[email protected]> | 2015-09-29 22:54:58 +0000 |
|---|---|---|
| committer | Dmitry Torokhov <[email protected]> | 2015-09-29 23:08:29 +0000 |
| commit | 218c1f76b8b25d6dc9d01443f071cb618e206b0c (patch) | |
| tree | ecd48ba4dadb9da65b5ccb3cb86afc8f692b1fdd /drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | |
| parent | Input: elan_i2c - add all valid ic type for i2c/smbus (diff) | |
| download | kernel-218c1f76b8b25d6dc9d01443f071cb618e206b0c.tar.gz kernel-218c1f76b8b25d6dc9d01443f071cb618e206b0c.zip | |
Input: psmouse - fix data race in __ps2_command
The data race happens on ps2dev->cmdcnt and ps2dev->cmdbuf contents.
__ps2_command reads that data concurrently with the interrupt handler. As
the result, for example, if a response arrives just after the timeout,
__ps2_command can copy out garbage from ps2dev->cmdbuf but then see that
ps2dev->cmdcnt is 0 and return success.
Stop the interrupt handler with serio_pause_rx() before reading the
results.
The data race was found with KernelThreadSanitizer (KTSAN).
Signed-off-by: Dmitry Vyukov <[email protected]>
Signed-off-by: Dmitry Torokhov <[email protected]>
Diffstat (limited to 'drivers/gpu/drm/amd/amdgpu/amdgpu_object.c')
0 files changed, 0 insertions, 0 deletions