[PATCH] input: fix input_open_file() accessing out-of-bound buffers
STALE5133d
From: David Herrmann <hidden>
Date: 2012-09-13 16:16:11
Subsystem:
input (keyboard, mouse, joystick, touchscreen) drivers, the rest · Maintainers:
Dmitry Torokhov, Linus Torvalds
The "input_table" array is very small and we cannot be sure that the file the user opens has a minor-ID below 256 (8 << 5). Hence, simply check that the minor isn't out-of-bounds. If it is, return -ENODEV. Signed-off-by: David Herrmann <redacted> Cc: <stable@kernel.org> --- drivers/input/input.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/drivers/input/input.c b/drivers/input/input.c
index 8921c61..eb65ad7 100644
--- a/drivers/input/input.c
+++ b/drivers/input/input.c@@ -2095,13 +2095,19 @@ static int input_open_file(struct inode *inode, struct file *file) struct input_handler *handler; const struct file_operations *old_fops, *new_fops = NULL; int err; + unsigned int minor_group; err = mutex_lock_interruptible(&input_mutex); if (err) return err; /* No load-on-demand here? */ - handler = input_table[iminor(inode) >> 5]; + + minor_group = iminor(inode) >> 5; + if (minor_group >= sizeof(input_table) / sizeof(*input_table)) + return -ENODEV; + + handler = input_table[minor_group]; if (handler) new_fops = fops_get(handler->fops);
--
1.7.12