]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
Input: evdev - fix EVIOCG{type} ioctl
authorDmitry Torokhov <dmitry.torokhov@gmail.com>
Mon, 6 Oct 2014 17:55:49 +0000 (10:55 -0700)
committerJiri Slaby <jslaby@suse.cz>
Wed, 19 Nov 2014 10:56:26 +0000 (11:56 +0100)
commitf9a3dbb8fd1853c16930b2c95eefa34a324eca19
treedea08550e7ec80b389aabc96a55a27cd15b81ba3
parent0bbf78fb0ac62ef6f0970a49d7e0a1fb79d10dce
Input: evdev - fix EVIOCG{type} ioctl

commit 7c4f56070fde2367766fa1fb04852599b5e1ad35 upstream.

The 'max' size passed into the function is measured in number of bits
(KEY_MAX, LED_MAX, etc) so we need to convert it accordingly before trying
to copy the data out, otherwise we will try copying too much and end up
with up with a page fault.

Reported-by: Pavel Machek <pavel@ucw.cz>
Reviewed-by: Pavel Machek <pavel@ucw.cz>
Reviewed-by: David Herrmann <dh.herrmann@gmail.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
drivers/input/evdev.c