[lvc-project] [PATCH v7 3/3] HID: roccat: avoid unlocked report buffer access in roccat_poll()

[Dmitry Antipov]

Since roccat_read() and roccat_report_event() uses per-device report
buffer holding 'cbuf_lock', fix roccat_poll() to do the same to avoid
race against them. Check for an actual device presense with recently
introduced roccat_device_available() before doing actuall poll as well.

Signed-off-by: Dmitry Antipov <dmantipov at yandex.ru>
---
v7: initial version to join the series
---
 drivers/hid/hid-roccat.c | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/drivers/hid/hid-roccat.c b/drivers/hid/hid-roccat.c
index 5cc523635445..0681b9cec93b 100644
--- a/drivers/hid/hid-roccat.c
+++ b/drivers/hid/hid-roccat.c
@@ -160,12 +160,18 @@ static ssize_t roccat_read(struct file *file, char __user *buffer,
 static __poll_t roccat_poll(struct file *file, poll_table *wait)
 {
 	struct roccat_reader *reader = file->private_data;
-	poll_wait(file, &reader->device->wait, wait);
-	if (reader->cbuf_start != reader->device->cbuf_end)
-		return EPOLLIN | EPOLLRDNORM;
+	bool avail;
+
 	if (!roccat_device_available(reader->device))
 		return EPOLLERR | EPOLLHUP;
-	return 0;
+
+	poll_wait(file, &reader->device->wait, wait);
+
+	mutex_lock(&reader->device->cbuf_lock);
+	avail = (reader->cbuf_start != reader->device->cbuf_end);
+	mutex_unlock(&reader->device->cbuf_lock);
+
+	return avail ? EPOLLIN | EPOLLRDNORM : 0;
 }
 
 static int roccat_open(struct inode *inode, struct file *file)
-- 
2.56.0