diff options
| author | Andrew Morton <akpm@osdl.org> | 2003-08-14 10:25:07 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@home.osdl.org> | 2003-08-14 10:25:07 -0700 |
| commit | b0489fd741f77e6ef00cf8e07f737db00e97f714 (patch) | |
| tree | 37f04869460fffeafb160f2e6fe6f50b0dc4872f /drivers | |
| parent | a6bc080d7da312908952e60675d661d0160314a9 (diff) | |
[PATCH] uinput oops and panic fix
From: Aristeu Sergio Rozanski Filho <aris@cathedrallabs.org>
verify maximum number of bits before using set_bit
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/input/misc/uinput.c | 33 |
1 files changed, 32 insertions, 1 deletions
diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c index 0843aa32165b..cc8c05b5912a 100644 --- a/drivers/input/misc/uinput.c +++ b/drivers/input/misc/uinput.c @@ -323,36 +323,67 @@ static int uinput_ioctl(struct inode *inode, struct file *file, unsigned int cmd retval = uinput_destroy_device(udev); break; - case UI_SET_EVBIT: + if (arg > EV_MAX) { + retval = -EINVAL; + break; + } set_bit(arg, udev->dev->evbit); break; case UI_SET_KEYBIT: + if (arg > KEY_MAX) { + retval = -EINVAL; + break; + } set_bit(arg, udev->dev->keybit); break; case UI_SET_RELBIT: + if (arg > REL_MAX) { + retval = -EINVAL; + break; + } set_bit(arg, udev->dev->relbit); break; case UI_SET_ABSBIT: + if (arg > ABS_MAX) { + retval = -EINVAL; + break; + } set_bit(arg, udev->dev->absbit); break; case UI_SET_MSCBIT: + if (arg > MSC_MAX) { + retval = -EINVAL; + break; + } set_bit(arg, udev->dev->mscbit); break; case UI_SET_LEDBIT: + if (arg > LED_MAX) { + retval = -EINVAL; + break; + } set_bit(arg, udev->dev->ledbit); break; case UI_SET_SNDBIT: + if (arg > SND_MAX) { + retval = -EINVAL; + break; + } set_bit(arg, udev->dev->sndbit); break; case UI_SET_FFBIT: + if (arg > FF_MAX) { + retval = -EINVAL; + break; + } set_bit(arg, udev->dev->ffbit); break; |