lkml.org 
[lkml]   [2022]   [May]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 03/33] Input: add bounds checking to input_set_capability()
    Date
    From: Jeff LaBundy <jeff@labundy.com>

    [ Upstream commit 409353cbe9fe48f6bc196114c442b1cff05a39bc ]

    Update input_set_capability() to prevent kernel panic in case the
    event code exceeds the bitmap for the given event type.

    Suggested-by: Tomasz Moń <tomasz.mon@camlingroup.com>
    Signed-off-by: Jeff LaBundy <jeff@labundy.com>
    Reviewed-by: Tomasz Moń <tomasz.mon@camlingroup.com>
    Link: https://lore.kernel.org/r/20220320032537.545250-1-jeff@labundy.com
    Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/input/input.c | 19 +++++++++++++++++++
    1 file changed, 19 insertions(+)

    diff --git a/drivers/input/input.c b/drivers/input/input.c
    index cadb368be8ef..f9f3d6261dc5 100644
    --- a/drivers/input/input.c
    +++ b/drivers/input/input.c
    @@ -50,6 +50,17 @@ static DEFINE_MUTEX(input_mutex);

    static const struct input_value input_value_sync = { EV_SYN, SYN_REPORT, 1 };

    +static const unsigned int input_max_code[EV_CNT] = {
    + [EV_KEY] = KEY_MAX,
    + [EV_REL] = REL_MAX,
    + [EV_ABS] = ABS_MAX,
    + [EV_MSC] = MSC_MAX,
    + [EV_SW] = SW_MAX,
    + [EV_LED] = LED_MAX,
    + [EV_SND] = SND_MAX,
    + [EV_FF] = FF_MAX,
    +};
    +
    static inline int is_event_supported(unsigned int code,
    unsigned long *bm, unsigned int max)
    {
    @@ -1915,6 +1926,14 @@ EXPORT_SYMBOL(input_free_device);
    */
    void input_set_capability(struct input_dev *dev, unsigned int type, unsigned int code)
    {
    + if (type < EV_CNT && input_max_code[type] &&
    + code > input_max_code[type]) {
    + pr_err("%s: invalid code %u for type %u\n", __func__, code,
    + type);
    + dump_stack();
    + return;
    + }
    +
    switch (type) {
    case EV_KEY:
    __set_bit(code, dev->keybit);
    --
    2.35.1


    \
     
     \ /
      Last update: 2022-05-23 19:10    [W:2.476 / U:0.012 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site