Commit b0489fd7 authored by Andrew Morton's avatar Andrew Morton Committed by Linus Torvalds

[PATCH] uinput oops and panic fix

From: Aristeu Sergio Rozanski Filho <aris@cathedrallabs.org>

verify maximum number of bits before using set_bit
parent a6bc080d
...@@ -323,36 +323,67 @@ static int uinput_ioctl(struct inode *inode, struct file *file, unsigned int cmd ...@@ -323,36 +323,67 @@ static int uinput_ioctl(struct inode *inode, struct file *file, unsigned int cmd
retval = uinput_destroy_device(udev); retval = uinput_destroy_device(udev);
break; break;
case UI_SET_EVBIT: case UI_SET_EVBIT:
if (arg > EV_MAX) {
retval = -EINVAL;
break;
}
set_bit(arg, udev->dev->evbit); set_bit(arg, udev->dev->evbit);
break; break;
case UI_SET_KEYBIT: case UI_SET_KEYBIT:
if (arg > KEY_MAX) {
retval = -EINVAL;
break;
}
set_bit(arg, udev->dev->keybit); set_bit(arg, udev->dev->keybit);
break; break;
case UI_SET_RELBIT: case UI_SET_RELBIT:
if (arg > REL_MAX) {
retval = -EINVAL;
break;
}
set_bit(arg, udev->dev->relbit); set_bit(arg, udev->dev->relbit);
break; break;
case UI_SET_ABSBIT: case UI_SET_ABSBIT:
if (arg > ABS_MAX) {
retval = -EINVAL;
break;
}
set_bit(arg, udev->dev->absbit); set_bit(arg, udev->dev->absbit);
break; break;
case UI_SET_MSCBIT: case UI_SET_MSCBIT:
if (arg > MSC_MAX) {
retval = -EINVAL;
break;
}
set_bit(arg, udev->dev->mscbit); set_bit(arg, udev->dev->mscbit);
break; break;
case UI_SET_LEDBIT: case UI_SET_LEDBIT:
if (arg > LED_MAX) {
retval = -EINVAL;
break;
}
set_bit(arg, udev->dev->ledbit); set_bit(arg, udev->dev->ledbit);
break; break;
case UI_SET_SNDBIT: case UI_SET_SNDBIT:
if (arg > SND_MAX) {
retval = -EINVAL;
break;
}
set_bit(arg, udev->dev->sndbit); set_bit(arg, udev->dev->sndbit);
break; break;
case UI_SET_FFBIT: case UI_SET_FFBIT:
if (arg > FF_MAX) {
retval = -EINVAL;
break;
}
set_bit(arg, udev->dev->ffbit); set_bit(arg, udev->dev->ffbit);
break; break;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment