From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
To: Henrik Rydberg <rydberg@bitmath.org>,
Dmitry Torokhov <dmitry.torokhov@gmail.com>
Cc: syzkaller-bugs@googlegroups.com,
syzbot <syzbot+0122fa359a69694395d5@syzkaller.appspotmail.com>,
akpm@linux-foundation.org,
"linux-input@vger.kernel.org" <linux-input@vger.kernel.org>
Subject: [PATCH] Input: MT - use __GFP_NOWARN allocation at input_mt_init_slots()
Date: Sat, 19 Nov 2022 16:09:56 +0900 [thread overview]
Message-ID: <6d878e01-6c2f-8766-2578-c95030442369@I-love.SAKURA.ne.jp> (raw)
In-Reply-To: <000000000000de2f4f05b8942be9@google.com>
syzbot is reporting too large allocation at input_mt_init_slots() {1], for
num_slots is supplied from userspace using ioctl(UI_DEV_CREATE).
Also, replace n2 with array_size(), for 32bits variable n2 will overflow
if num_slots >= 65536.
Link: https://syzkaller.appspot.com/bug?extid=0122fa359a69694395d5 [1]
Reported-by: syzbot <syzbot+0122fa359a69694395d5@syzkaller.appspotmail.com>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
---
drivers/input/input-mt.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/input/input-mt.c b/drivers/input/input-mt.c
index 14b53dac1253..cf74579462ba 100644
--- a/drivers/input/input-mt.c
+++ b/drivers/input/input-mt.c
@@ -47,7 +47,7 @@ int input_mt_init_slots(struct input_dev *dev, unsigned int num_slots,
if (mt)
return mt->num_slots != num_slots ? -EINVAL : 0;
- mt = kzalloc(struct_size(mt, slots, num_slots), GFP_KERNEL);
+ mt = kzalloc(struct_size(mt, slots, num_slots), GFP_KERNEL | __GFP_NOWARN);
if (!mt)
goto err_mem;
@@ -80,8 +80,8 @@ int input_mt_init_slots(struct input_dev *dev, unsigned int num_slots,
if (flags & INPUT_MT_SEMI_MT)
__set_bit(INPUT_PROP_SEMI_MT, dev->propbit);
if (flags & INPUT_MT_TRACK) {
- unsigned int n2 = num_slots * num_slots;
- mt->red = kcalloc(n2, sizeof(*mt->red), GFP_KERNEL);
+ mt->red = kcalloc(array_size(num_slots, num_slots),
+ sizeof(*mt->red), GFP_KERNEL | __GFP_NOWARN);
if (!mt->red)
goto err_mem;
}
--
2.34.1
next prev parent reply other threads:[~2022-11-19 7:10 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-01-10 23:30 WARNING in input_mt_init_slots syzbot
2021-01-10 23:30 ` syzbot
2022-11-19 7:09 ` Tetsuo Handa [this message]
2022-11-22 23:23 ` [PATCH] Input: MT - use __GFP_NOWARN allocation at input_mt_init_slots() Dmitry Torokhov
2022-11-23 0:28 ` Tetsuo Handa
2024-04-27 11:15 ` [PATCH v2] Input: MT - limit max slots Tetsuo Handa
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6d878e01-6c2f-8766-2578-c95030442369@I-love.SAKURA.ne.jp \
--to=penguin-kernel@i-love.sakura.ne.jp \
--cc=akpm@linux-foundation.org \
--cc=dmitry.torokhov@gmail.com \
--cc=linux-input@vger.kernel.org \
--cc=rydberg@bitmath.org \
--cc=syzbot+0122fa359a69694395d5@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.