⬢ DragonFlyBSD Kernel Audit
DF-5369 / fix.diff
← back to finding ↓ download raw
--- a/sys/bus/u4b/input/ums.c
+++ b/sys/bus/u4b/input/ums.c
@@ -740,7 +740,12 @@
 	for (i = 0; i < info->sc_buttons; i++)
 		evdev_support_key(sc->sc_evdev, BTN_MOUSE + i);
 
-	err = evdev_register(sc->sc_evdev);
+	/* DF-5369: use sc_lock as the evdev state lock so that ev_open/
+	 * ev_close (called by evdev under the state lock) and the intr
+	 * callback's evdev_push_* (called under sc_lock) share ONE lock
+	 * instead of nesting sc_lock <-> ev_mtx in opposite orders.  sc_lock
+	 * is initialised LK_CANRECURSE, so the nesting is safe. */
+	err = evdev_register_mtx(sc->sc_evdev, &sc->sc_lock);
 	if (err)
 		goto detach;
 #endif