]>
Commit | Line | Data |
---|---|---|
20bc09b2 GKH |
1 | From d77651a227f8920dd7ec179b84e400cce844eeb3 Mon Sep 17 00:00:00 2001 |
2 | From: Dmitry Torokhov <dmitry.torokhov@gmail.com> | |
3 | Date: Mon, 14 Jan 2019 13:54:55 -0800 | |
4 | Subject: Input: uinput - fix undefined behavior in uinput_validate_absinfo() | |
5 | ||
6 | From: Dmitry Torokhov <dmitry.torokhov@gmail.com> | |
7 | ||
8 | commit d77651a227f8920dd7ec179b84e400cce844eeb3 upstream. | |
9 | ||
10 | An integer overflow may arise in uinput_validate_absinfo() if "max - min" | |
11 | can't be represented by an "int". We should check for overflow before | |
12 | trying to use the result. | |
13 | ||
14 | Reported-by: Kyungtae Kim <kt0755@gmail.com> | |
15 | Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net> | |
16 | Cc: stable@vger.kernel.org | |
17 | Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> | |
18 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | |
19 | ||
20 | --- | |
21 | drivers/input/misc/uinput.c | 5 +++-- | |
22 | 1 file changed, 3 insertions(+), 2 deletions(-) | |
23 | ||
24 | --- a/drivers/input/misc/uinput.c | |
25 | +++ b/drivers/input/misc/uinput.c | |
26 | @@ -39,6 +39,7 @@ | |
27 | #include <linux/fs.h> | |
28 | #include <linux/miscdevice.h> | |
29 | #include <linux/uinput.h> | |
30 | +#include <linux/overflow.h> | |
31 | #include <linux/input/mt.h> | |
32 | #include "../input-compat.h" | |
33 | ||
34 | @@ -356,7 +357,7 @@ static int uinput_open(struct inode *ino | |
35 | static int uinput_validate_absinfo(struct input_dev *dev, unsigned int code, | |
36 | const struct input_absinfo *abs) | |
37 | { | |
38 | - int min, max; | |
39 | + int min, max, range; | |
40 | ||
41 | min = abs->minimum; | |
42 | max = abs->maximum; | |
43 | @@ -368,7 +369,7 @@ static int uinput_validate_absinfo(struc | |
44 | return -EINVAL; | |
45 | } | |
46 | ||
47 | - if (abs->flat > max - min) { | |
48 | + if (!check_sub_overflow(max, min, &range) && abs->flat > range) { | |
49 | printk(KERN_DEBUG | |
50 | "%s: abs_flat #%02x out of range: %d (min:%d/max:%d)\n", | |
51 | UINPUT_NAME, code, abs->flat, min, max); |