[PATCH] input: fix input_open_file() accessing out-of-bound buffers

The "input_table" array is very small and we cannot be sure that the file
the user opens has a minor-ID below 256 (8 << 5). Hence, simply check that
the minor isn't out-of-bounds. If it is, return -ENODEV.

Signed-off-by: David Herrmann <redacted>
Cc: <stable@kernel.org>
---
 drivers/input/input.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/input/input.c b/drivers/input/input.c
index 8921c61..eb65ad7 100644
--- a/drivers/input/input.c
+++ b/drivers/input/input.c

@@ -2095,13 +2095,19 @@ static int input_open_file(struct inode *inode, struct file *file)
 	struct input_handler *handler;
 	const struct file_operations *old_fops, *new_fops = NULL;
 	int err;
+	unsigned int minor_group;
 
 	err = mutex_lock_interruptible(&input_mutex);
 	if (err)
 		return err;
 
 	/* No load-on-demand here? */
-	handler = input_table[iminor(inode) >> 5];
+
+	minor_group = iminor(inode) >> 5;
+	if (minor_group >= sizeof(input_table) / sizeof(*input_table))
+		return -ENODEV;
+
+	handler = input_table[minor_group];
 	if (handler)
 		new_fops = fops_get(handler->fops);
 

-- 
1.7.12

Hi Dmitry

On Thu, Sep 13, 2012 at 6:17 PM, David Herrmann
[off-list ref] wrote:

The "input_table" array is very small and we cannot be sure that the file
the user opens has a minor-ID below 256 (8 << 5). Hence, simply check that
the minor isn't out-of-bounds. If it is, return -ENODEV.

Signed-off-by: David Herrmann <redacted>
Cc: <stable@kernel.org>

This should be "Cc: [off-list ref]". Sorry for the typo.

Thanks
David

Hi David,

On Thu, Sep 13, 2012 at 06:18:17PM +0200, David Herrmann wrote:

Hi Dmitry

On Thu, Sep 13, 2012 at 6:17 PM, David Herrmann
[off-list ref] wrote:

quoted

The "input_table" array is very small and we cannot be sure that the file
the user opens has a minor-ID below 256 (8 << 5). Hence, simply check that
the minor isn't out-of-bounds. If it is, return -ENODEV.

Signed-off-by: David Herrmann <redacted>
Cc: <stable@kernel.org>

This should be "Cc: [off-list ref]". Sorry for the typo.

register_chrdev() reserves exactly 256 minors so it is not possible for
input_open_file() to be called with minor that will get us out of
bounds.

Thanks.

-- 
Dmitry

Hi Dmitry

On Thu, Sep 13, 2012 at 6:57 PM, Dmitry Torokhov
[off-list ref] wrote:

Hi David,

On Thu, Sep 13, 2012 at 06:18:17PM +0200, David Herrmann wrote:

quoted

Hi Dmitry

On Thu, Sep 13, 2012 at 6:17 PM, David Herrmann
[off-list ref] wrote:

quoted

The "input_table" array is very small and we cannot be sure that the file
the user opens has a minor-ID below 256 (8 << 5). Hence, simply check that
the minor isn't out-of-bounds. If it is, return -ENODEV.

Signed-off-by: David Herrmann <redacted>
Cc: <stable@kernel.org>

This should be "Cc: [off-list ref]". Sorry for the typo.

register_chrdev() reserves exactly 256 minors so it is not possible for
input_open_file() to be called with minor that will get us out of
bounds.

Ah, magic numbers. I love them!
But thanks, good to know, as I am currently working on integrating
dynamic-minors.

Sorry for the noise. Regards
David