Memoryless force-feedback devices use a timer to manage playback of effects. When a driver for such a device is unbound (or the device is unregistered for other reasons), the driver typically frees its private data synchronously. However, the input_dev structure (and its associated force-feedback structures, including the timer) is only freed when the last user closes the corresponding device node. If userspace keeps the device node open while the device is unregistered (e.g., during driver unbind), the force-feedback timer can still fire after the driver's private data has been freed. Introduce a new 'stop' callback to struct ff_device, and call it from input_unregister_device() before the device is deleted. Implement this callback for memoryless devices and synchronously shut down the timer to ensure it is stopped and cannot be rearmed once unregistration happens.
Showing the changes to include (1 of 3 files). Show all
Unified · Split
| @@ -543,6 +543,8 @@ extern const struct class input_class; · 542 unmodified lines | |||
| 543 | * @set_autocenter: Called to auto-center device | 543 | * @set_autocenter: Called to auto-center device |
| 544 | * @destroy: called by input core when parent input device is being | 544 | * @destroy: called by input core when parent input device is being |
| 545 | * destroyed | 545 | * destroyed |
| 546 | * @stop: called by input core when parent input device is being | ||
| 547 | * unregistered | ||
| 546 | * @private: driver-specific data, will be freed automatically | 548 | * @private: driver-specific data, will be freed automatically |
| 547 | * @ffbit: bitmap of force feedback capabilities truly supported by | 549 | * @ffbit: bitmap of force feedback capabilities truly supported by |
| 548 | * device (not emulated like ones in input_dev->ffbit) | 550 | * device (not emulated like ones in input_dev->ffbit) |
| @@ -571,6 +573,7 @@ struct ff_device { · 22 unmodified lines | |||
| 571 | void (*set_autocenter)(struct input_dev *dev, u16 magnitude); | 573 | void (*set_autocenter)(struct input_dev *dev, u16 magnitude); |
| 572 | 574 | ||
| 573 | void (*destroy)(struct ff_device *); | 575 | void (*destroy)(struct ff_device *); |
| 576 | void (*stop)(struct ff_device *); | ||
| 574 | 577 | ||
| 575 | void *private; | 578 | void *private; |
| 576 | 579 | ||