lkml.org 
[lkml]   [2019]   [Jan]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.20 068/117] Input: uinput - fix undefined behavior in uinput_validate_absinfo()
    Date
    4.20-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Dmitry Torokhov <dmitry.torokhov@gmail.com>

    commit d77651a227f8920dd7ec179b84e400cce844eeb3 upstream.

    An integer overflow may arise in uinput_validate_absinfo() if "max - min"
    can't be represented by an "int". We should check for overflow before
    trying to use the result.

    Reported-by: Kyungtae Kim <kt0755@gmail.com>
    Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
    Cc: stable@vger.kernel.org
    Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/input/misc/uinput.c | 5 +++--
    1 file changed, 3 insertions(+), 2 deletions(-)

    --- a/drivers/input/misc/uinput.c
    +++ b/drivers/input/misc/uinput.c
    @@ -39,6 +39,7 @@
    #include <linux/init.h>
    #include <linux/fs.h>
    #include <linux/miscdevice.h>
    +#include <linux/overflow.h>
    #include <linux/input/mt.h>
    #include "../input-compat.h"

    @@ -405,7 +406,7 @@ static int uinput_open(struct inode *ino
    static int uinput_validate_absinfo(struct input_dev *dev, unsigned int code,
    const struct input_absinfo *abs)
    {
    - int min, max;
    + int min, max, range;

    min = abs->minimum;
    max = abs->maximum;
    @@ -417,7 +418,7 @@ static int uinput_validate_absinfo(struc
    return -EINVAL;
    }

    - if (abs->flat > max - min) {
    + if (!check_sub_overflow(max, min, &range) && abs->flat > range) {
    printk(KERN_DEBUG
    "%s: abs_flat #%02x out of range: %d (min:%d/max:%d)\n",
    UINPUT_NAME, code, abs->flat, min, max);

    \
     
     \ /
      Last update: 2019-01-29 13:06    [W:4.177 / U:0.008 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site