Re: [PATCH] input: polldev can cause crash in case of polling disabled
From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Date: 2010-02-16 17:51:10
From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Date: 2010-02-16 17:51:10
Hi Samu, On Tue, Feb 16, 2010 at 04:44:41PM +0200, Samu Onkalo wrote:
If polling is set to disabled value and polled input device is opened and closed several times, address to workqueue will probably change at some point. Since nothing is queued (due to polled disabled state), content of the work struct contains pointer to the old and non-existent workqueue.
This I do not quite understand. The work struct as far as I can see does not reference workqueue at all. There is a list entry but if we do not poll the device that entry should be always detached from any lists. We properly initialize WQ entry when we create the device and it shoudl remain valid until the device is destroyed.
When the device is closed again, cancel_delayed_work_sync goes crazy due to pointer to nonexisting workqueue.
What kind of failure do you see? Is there a stack trace or something?
In case on disabled polling, init work struct to initial value to clean up the old values.
Also, why would not we see the same issue with enabled polling? The workqueue is being created and destroyed in this case as well. Thanks. -- Dmitry