diff options
| author | Jeff LaBundy <jeff@labundy.com> | 2022-03-20 21:55:27 -0700 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2022-05-25 09:10:37 +0200 |
| commit | 01d41d7e7fc7eef99ae5b1065d9186f91ff099e7 (patch) | |
| tree | e279ebecf9b347862f112e83c30b6608eb6d0e13 /drivers/input | |
| parent | a309c34e52abc173e65f5cacc96a08679c9dfa3f (diff) | |
| download | linux-stable-01d41d7e7fc7eef99ae5b1065d9186f91ff099e7.tar.gz linux-stable-01d41d7e7fc7eef99ae5b1065d9186f91ff099e7.tar.bz2 linux-stable-01d41d7e7fc7eef99ae5b1065d9186f91ff099e7.zip | |
Input: add bounds checking to input_set_capability()
[ Upstream commit 409353cbe9fe48f6bc196114c442b1cff05a39bc ]
Update input_set_capability() to prevent kernel panic in case the
event code exceeds the bitmap for the given event type.
Suggested-by: Tomasz Moń <tomasz.mon@camlingroup.com>
Signed-off-by: Jeff LaBundy <jeff@labundy.com>
Reviewed-by: Tomasz Moń <tomasz.mon@camlingroup.com>
Link: https://lore.kernel.org/r/20220320032537.545250-1-jeff@labundy.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'drivers/input')
| -rw-r--r-- | drivers/input/input.c | 19 |
1 files changed, 19 insertions, 0 deletions
diff --git a/drivers/input/input.c b/drivers/input/input.c index a0d90022fcf7..dcbf53b5b2bc 100644 --- a/drivers/input/input.c +++ b/drivers/input/input.c @@ -50,6 +50,17 @@ static DEFINE_MUTEX(input_mutex); static const struct input_value input_value_sync = { EV_SYN, SYN_REPORT, 1 }; +static const unsigned int input_max_code[EV_CNT] = { + [EV_KEY] = KEY_MAX, + [EV_REL] = REL_MAX, + [EV_ABS] = ABS_MAX, + [EV_MSC] = MSC_MAX, + [EV_SW] = SW_MAX, + [EV_LED] = LED_MAX, + [EV_SND] = SND_MAX, + [EV_FF] = FF_MAX, +}; + static inline int is_event_supported(unsigned int code, unsigned long *bm, unsigned int max) { @@ -1915,6 +1926,14 @@ EXPORT_SYMBOL(input_free_device); */ void input_set_capability(struct input_dev *dev, unsigned int type, unsigned int code) { + if (type < EV_CNT && input_max_code[type] && + code > input_max_code[type]) { + pr_err("%s: invalid code %u for type %u\n", __func__, code, + type); + dump_stack(); + return; + } + switch (type) { case EV_KEY: __set_bit(code, dev->keybit); |