svn commit: r315177 - head/sys/dev/evdev

[Oleksandr Tymoshenko]

Author: gonzo
Date: Sun Mar 12 19:27:44 2017
New Revision: 315177
URL: https://svnweb.freebsd.org/changeset/base/315177

Log:
  [evdev] Fix race condition between client's event queue reading and dropping
  
  Submitted by:	Vladimir Kondratiev <wulf at cicgroup.ru>
  MFC after:	1 week
  Differential Revision:	https://reviews.freebsd.org/D9320

Modified:
  head/sys/dev/evdev/cdev.c

Modified: head/sys/dev/evdev/cdev.c
==============================================================================
--- head/sys/dev/evdev/cdev.c	Sun Mar 12 19:26:24 2017	(r315176)
+++ head/sys/dev/evdev/cdev.c	Sun Mar 12 19:27:44 2017	(r315177)
@@ -162,7 +162,7 @@ static int
 evdev_read(struct cdev *dev, struct uio *uio, int ioflag)
 {
 	struct evdev_client *client;
-	struct input_event *event;
+	struct input_event event;
 	int ret = 0;
 	int remaining;
 
@@ -197,13 +197,14 @@ evdev_read(struct cdev *dev, struct uio 
 	}
 
 	while (ret == 0 && !EVDEV_CLIENT_EMPTYQ(client) && remaining > 0) {
-		event = &client->ec_buffer[client->ec_buffer_head];
+		memcpy(&event, &client->ec_buffer[client->ec_buffer_head],
+		    sizeof(struct input_event));
 		client->ec_buffer_head =
 		    (client->ec_buffer_head + 1) % client->ec_buffer_size;
 		remaining--;
 
 		EVDEV_CLIENT_UNLOCKQ(client);
-		ret = uiomove(event, sizeof(struct input_event), uio);
+		ret = uiomove(&event, sizeof(struct input_event), uio);
 		EVDEV_CLIENT_LOCKQ(client);
 	}