Commit e7507ed9 authored by Dmitry Torokhov's avatar Dmitry Torokhov Committed by Linus Torvalds

[PATCH] uniput - fix crash on SMP

Only signal completion after marking request slot as free, otherwise other
processor can free request structure before we finish using it.
Signed-off-by: default avatarDmitry Torokhov <dtor@mail.ru>
Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
parent 5cc9eeef
...@@ -90,11 +90,11 @@ static inline int uinput_request_reserve_slot(struct uinput_device *udev, struct ...@@ -90,11 +90,11 @@ static inline int uinput_request_reserve_slot(struct uinput_device *udev, struct
static void uinput_request_done(struct uinput_device *udev, struct uinput_request *request) static void uinput_request_done(struct uinput_device *udev, struct uinput_request *request)
{ {
complete(&request->done);
/* Mark slot as available */ /* Mark slot as available */
udev->requests[request->id] = NULL; udev->requests[request->id] = NULL;
wake_up_interruptible(&udev->requests_waitq); wake_up_interruptible(&udev->requests_waitq);
complete(&request->done);
} }
static int uinput_request_submit(struct input_dev *dev, struct uinput_request *request) static int uinput_request_submit(struct input_dev *dev, struct uinput_request *request)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment