Skip to contentSkip to conversation

uinput oops in 2.5.41

PATCH Maciej Babinski 3 participants 3 messages Oct 9, 2002 – Oct 10, 2002 Input drivers

lore
Share & tools
lore

Maciej Babinski

author
#0 lore raw

I get a NULL pointer dereference by running "cat" on /dev/misc/uinput I'm a newbie, but I think the patch at the bottom fixes it.

ksymoops 2.4.6 on i586 2.5.41. Options used
-v /usr/src/linux/vmlinux (specified)
-k /proc/ksyms (default)
-l /proc/modules (default)
-o /lib/modules/2.5.41/ (default)
-m /usr/src/linux/System.map (default)

Unable to handle kernel NULL pointer dereference at virtual address 00000004
c0112986
*pde = 00000000
Oops: 0002
CPU:    0
EIP:    0060:[<c0112986>]    Not tainted

Using defaults from ksymoops -t elf32-i386 -a i386
EFLAGS: 00010046
eax: c521e008 ebx: 00000000 ecx: c3919f5c edx: c3919f50
esi: 00000246 edi: c3918000 ebp: c3b76b40 esp: c3919f20
ds: 0068 es: 0068 ss: 0068

Stack: c521e000 00000000 c69305cd c521e008 00000000 c3cfd380 c01118c0 00000000 
       00000000 00000000 00000000 00000000 00000000 c3cfd380 c01118c0 00000000 
       00000000 00000000 c3919f7c bffff864 c3b76b40 0804e758 00000400 c3b76b60 
Call Trace: [<c69305cd>]  [<c01118c0>]  [<c01118c0>]  [<c0137f09>]  [<c013803a>]  [<c0107357>] 
Code: 89 4b 04 89 41 04 56 9d 5b 5e c3 90 8d b4 26 00 00 00 00 8d
Quoted 8 lines
Quoted 8 lines

EIP; c0112986 <add_wait_queue+16/30> <=====

eax; c521e008 <_end+4f5f81c/6543814>
ecx; c3919f5c <_end+365b770/6543814>
edx; c3919f50 <_end+365b764/6543814>
edi; c3918000 <_end+3659814/6543814>
ebp; c3b76b40 <_end+38b8354/6543814>
esp; c3919f20 <_end+365b734/6543814>

Trace; c69305cd <[uinput]uinput_read+fd/170>
Trace; c01118c0 <default_wake_function+0/40>
Trace; c01118c0 <default_wake_function+0/40>
Trace; c0137f09 <vfs_read+99/d0>
Trace; c013803a <sys_read+2a/40>
Trace; c0107357 <syscall_call+7/b>

Code; c0112986 <add_wait_queue+16/30>
00000000 <_EIP>:
Code; c0112986 <add_wait_queue+16/30> <=====
0: 89 4b 04 mov %ecx,0x4(%ebx) <=====
Code; c0112989 <add_wait_queue+19/30>
3: 89 41 04 mov %eax,0x4(%ecx)
Code; c011298c <add_wait_queue+1c/30>
6: 56 push %esi
Code; c011298d <add_wait_queue+1d/30>
7: 9d popf
Code; c011298e <add_wait_queue+1e/30>
8: 5b pop %ebx
Code; c011298f <add_wait_queue+1f/30>
9: 5e pop %esi
Code; c0112990 <add_wait_queue+20/30>
a: c3 ret
Code; c0112991 <add_wait_queue+21/30>
b: 90 nop
Code; c0112992 <add_wait_queue+22/30>
c: 8d b4 26 00 00 00 00 lea 0x0(%esi,1),%esi
Code; c0112999 <add_wait_queue+29/30>
13: 8d 00 lea (%eax),%eax

drivers/input/misc/uinput.c +3 -4
@@ -224,15 +224,14 @@
 
 	udev = (struct uinput_device *)file->private_data;
 
+	if (!(udev->state & UIST_CREATED))
+		return -ENODEV;
+
 	if (udev->head == udev->tail) {
 		add_wait_queue(&udev->waitq, &waitq);
 		current->state = TASK_INTERRUPTIBLE;
 
 		while (udev->head == udev->tail) {
-			if (!(udev->state & UIST_CREATED)) {
-				retval = -ENODEV;
-				break;
-			}
 			if (file->f_flags & O_NONBLOCK) {
 				retval = -EAGAIN;
 				break;
#1 lore raw
Quoted 14 lines · Maciej Babinski

I get a NULL pointer dereference by running "cat" on /dev/misc/uinput I'm a newbie, but I think the patch at the bottom fixes it.

drivers/input/misc/uinput.c +3 -0
@@ -224,15 +224,14 @@
 
 	udev = (struct uinput_device *)file->private_data;
 
+	if (!(udev->state & UIST_CREATED))
+		return -ENODEV;
+
 	if (udev->head == udev->tail) {
 		add_wait_queue(&udev->waitq, &waitq);

drivers/input/misc/uinput.c line 237

Quoted 10 lines
drivers/input/misc/uinput.c +0 -4
 		current->state = TASK_INTERRUPTIBLE;
 
 		while (udev->head == udev->tail) {
-			if (!(udev->state & UIST_CREATED)) {
-				retval = -ENODEV;
-				break;
-			}
 			if (file->f_flags & O_NONBLOCK) {
 				retval = -EAGAIN;
 				break;

Your patch is almost correct - you have to keep both the checks. The first could happen when the device disappears while being waited for.

Signature · 2 lines
Vojtech Pavlik
SuSE Labs
#2 lore raw
Quoted 9 lines · Vojtech Pavlik
Quoted 2 lines · Maciej Babinski

I get a NULL pointer dereference by running "cat" on /dev/misc/uinput I'm a newbie, but I think the patch at the bottom fixes it.

Your patch is almost correct - you have to keep both the checks. The first could happen when the device disappears while being waited for.

I've added this to my backport to 2.4. I'll be posting it very shortly under the subject 'backport of uinput.c to 2.4, fixes for 2.5'. This will include numerous additional fixes to uinput.c.

Cheers,

Zach Welch
Superlucidity Services