HID: i2c-hid: fix race condition reading reports
authorJean-Baptiste Maneyrol <jmaneyrol@invensense.com>
Wed, 19 Nov 2014 16:46:37 +0000 (00:46 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 16 Jan 2015 14:59:01 +0000 (06:59 -0800)
commitcaa853b3d80473ec7a646a7e163ddf8bc1f4ef46
treed763df1652a8c91a1a16ffc7790bb3465dfa692f
parentb658f2ad07e5e15a8e29bb95740452bd5b6a8eea
HID: i2c-hid: fix race condition reading reports

commit 6296f4a8eb86f9abcc370fb7a1a116b8441c17fd upstream.

Current driver uses a common buffer for reading reports either
synchronously in i2c_hid_get_raw_report() and asynchronously in
the interrupt handler.
There is race condition if an interrupt arrives immediately after
the report is received in i2c_hid_get_raw_report(); the common
buffer is modified by the interrupt handler with the new report
and then i2c_hid_get_raw_report() proceed using wrong data.

Fix it by using a separate buffers for synchronous reports.

Signed-off-by: Jean-Baptiste Maneyrol <jmaneyrol@invensense.com>
[Antonio Borneo: cleanup, rebase to v3.17, submit mainline]
Signed-off-by: Antonio Borneo <borneo.antonio@gmail.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/hid/i2c-hid/i2c-hid.c