From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752177AbbIQRa2 (ORCPT ); Thu, 17 Sep 2015 13:30:28 -0400 Received: from mail-wi0-f177.google.com ([209.85.212.177]:36612 "EHLO mail-wi0-f177.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751976AbbIQRa0 (ORCPT ); Thu, 17 Sep 2015 13:30:26 -0400 From: Elias Vanderstuyft To: Dmitry Torokhov Cc: linux-input@vger.kernel.org, linux-api@vger.kernel.org, linux-kernel@vger.kernel.org, Elias Vanderstuyft Subject: [PATCH 2/2] Input: uinput: Sanity check on ff_effects_max and EV_FF Date: Thu, 17 Sep 2015 19:29:48 +0200 Message-Id: <1442510988-3164-3-git-send-email-elias.vds@gmail.com> X-Mailer: git-send-email 1.9.3 In-Reply-To: <1442510988-3164-1-git-send-email-elias.vds@gmail.com> References: <1442510988-3164-1-git-send-email-elias.vds@gmail.com> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Currently the user can specify a non-zero value for ff_effects_max, without setting the EV_FF bit. Inversely, the user can also set ff_effects_max to zero with the EV_FF bit set, in this case the uninitialized method ff->upload can be dereferenced, resulting in a kernel oops. Instead of adding a check in uinput_create_device() and omitting setup of ff-core infrastructure silently in case the check fails, perform the check early in uinput_setup_device(), and print a helpful message and return -EINVAL in case the check fails. Signed-off-by: Elias Vanderstuyft --- drivers/input/misc/uinput.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c index 345df9b..3a90a16 100644 --- a/drivers/input/misc/uinput.c +++ b/drivers/input/misc/uinput.c @@ -393,6 +393,21 @@ static int uinput_setup_device(struct uinput_device *udev, if (IS_ERR(user_dev)) return PTR_ERR(user_dev); + if (!!user_dev->ff_effects_max ^ test_bit(EV_FF, dev->evbit)) { + if (user_dev->ff_effects_max) + printk(KERN_DEBUG + "%s: ff_effects_max (%u) should be zero " + "when FF_BIT is not set\n", + UINPUT_NAME, user_dev->ff_effects_max); + else + printk(KERN_DEBUG + "%s: ff_effects_max should be non-zero " + "when FF_BIT is set\n", + UINPUT_NAME); + retval = -EINVAL; + goto exit; + } + udev->ff_effects_max = user_dev->ff_effects_max; /* Ensure name is filled in */ -- 1.9.3 From mboxrd@z Thu Jan 1 00:00:00 1970 From: Elias Vanderstuyft Subject: [PATCH 2/2] Input: uinput: Sanity check on ff_effects_max and EV_FF Date: Thu, 17 Sep 2015 19:29:48 +0200 Message-ID: <1442510988-3164-3-git-send-email-elias.vds@gmail.com> References: <1442510988-3164-1-git-send-email-elias.vds@gmail.com> Return-path: In-Reply-To: <1442510988-3164-1-git-send-email-elias.vds-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> Sender: linux-api-owner-u79uwXL29TY76Z2rM5mHXA@public.gmane.org To: Dmitry Torokhov Cc: linux-input-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, linux-api-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, Elias Vanderstuyft List-Id: linux-input@vger.kernel.org Currently the user can specify a non-zero value for ff_effects_max, without setting the EV_FF bit. Inversely, the user can also set ff_effects_max to zero with the EV_FF bit set, in this case the uninitialized method ff->upload can be dereferenced, resulting in a kernel oops. Instead of adding a check in uinput_create_device() and omitting setup of ff-core infrastructure silently in case the check fails, perform the check early in uinput_setup_device(), and print a helpful message and return -EINVAL in case the check fails. Signed-off-by: Elias Vanderstuyft --- drivers/input/misc/uinput.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c index 345df9b..3a90a16 100644 --- a/drivers/input/misc/uinput.c +++ b/drivers/input/misc/uinput.c @@ -393,6 +393,21 @@ static int uinput_setup_device(struct uinput_device *udev, if (IS_ERR(user_dev)) return PTR_ERR(user_dev); + if (!!user_dev->ff_effects_max ^ test_bit(EV_FF, dev->evbit)) { + if (user_dev->ff_effects_max) + printk(KERN_DEBUG + "%s: ff_effects_max (%u) should be zero " + "when FF_BIT is not set\n", + UINPUT_NAME, user_dev->ff_effects_max); + else + printk(KERN_DEBUG + "%s: ff_effects_max should be non-zero " + "when FF_BIT is set\n", + UINPUT_NAME); + retval = -EINVAL; + goto exit; + } + udev->ff_effects_max = user_dev->ff_effects_max; /* Ensure name is filled in */ -- 1.9.3