Thread (14 messages) 14 messages, 3 authors, 2010-02-19

Re: [PATCH] input: polldev can cause crash in case of polling disabled

From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Date: 2010-02-16 17:51:10

Hi Samu,

On Tue, Feb 16, 2010 at 04:44:41PM +0200, Samu Onkalo wrote:
If polling is set to disabled value and polled input device
is opened and closed several times, address to workqueue will probably
change at some point. Since nothing is queued (due to polled disabled
state), content of the work struct contains pointer to the old and non-existent
workqueue.
This I do not quite understand. The work struct as far as I can see does
not reference workqueue at all. There is a list entry but if we do not
poll the device that entry should be always detached from any lists. We
properly initialize WQ entry when we create the device and it shoudl
remain valid until the device is destroyed.
When the device is closed again, cancel_delayed_work_sync
goes crazy due to pointer to nonexisting workqueue.
What kind of failure do you see? Is there a stack trace or something?
In case on disabled polling, init work struct to initial value to
clean up the old values.
Also, why would not we see the same issue with enabled polling? The
workqueue is being created and destroyed in this case as well.

Thanks.

-- 
Dmitry
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help