-
Kent Gibson authored
The initialisation of the linereq events kfifo relies on the struct being zeroed and a subsequent call to kfifo_alloc(). The call to kfifo_alloc() is deferred until edge detection is first enabled for the linereq. If the kfifo is inadvertently accessed before the call to kfifo_alloc(), as was the case in a recently discovered bug, it behaves as a FIFO of size 1 with an element size of 0, so writes and reads to the kfifo appear successful but copy no actual data. As a defensive measure, initialise the kfifo with INIT_KFIFO() when the events kfifo is constructed. This initialises the kfifo element size and zeroes its data pointer, so any inadvertant access prior to the kfifo_alloc() call will trigger an oops. Signed-off-by:
Kent Gibson <warthog618@gmail.com> Link: https://lore.kernel.org/r/20240529131953.195777-2-warthog618@gmail.comSigned-off-by:
Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
35d848e7