From patchwork Thu Sep 17 17:29:48 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Elias Vanderstuyft X-Patchwork-Id: 7209291 Return-Path: X-Original-To: patchwork-linux-input@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork1.web.kernel.org (Postfix) with ESMTP id CF0259F380 for ; Thu, 17 Sep 2015 17:30:45 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id EE0BA20142 for ; Thu, 17 Sep 2015 17:30:44 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 0E9D420751 for ; Thu, 17 Sep 2015 17:30:44 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752114AbbIQRa1 (ORCPT ); Thu, 17 Sep 2015 13:30:27 -0400 Received: from mail-wi0-f177.google.com ([209.85.212.177]:36612 "EHLO mail-wi0-f177.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751976AbbIQRa0 (ORCPT ); Thu, 17 Sep 2015 13:30:26 -0400 Received: by wicgb1 with SMTP id gb1so515740wic.1; Thu, 17 Sep 2015 10:30:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=eIm0Rrto6bf0lJ7Rpk/RMCK+z88HCdG1Lpqat8QsTWI=; b=ly+tSS9KtbKK21h+HiZt04rzn+J7mDCWZVZBFCrshHiwjIYlSGXMhxbXsCOh5jgCL0 hDSoVjJgG+79P4cx43IpQ58cKNRQu2TKIyeU4j9hjQ30GUj2y+0tsJQrW4GtT6AvZKU8 3SQGnpbPTxILO5HlepsEz0BMi3yk5fzbEv+Ytf/x0ZgfgfO9n4gVM0C8+ZFLgRME2Isi 6+6NPcov5lHd8Atjoxtax0cmSNhOP+j0dTidcUpK+CUUSBZ+/gORwXI0zaRAvYgUdZ+Q vmvFhJR8C3cMEI7A6dHLGdPKhE23YaS3l2/b2YyyBkLE5YVVWuVCmwfihlPuOMRSzMuX Poew== X-Received: by 10.194.171.129 with SMTP id au1mr510507wjc.115.1442511024941; Thu, 17 Sep 2015 10:30:24 -0700 (PDT) Received: from localhost.localdomain (d8D877437.access.telenet.be. [141.135.116.55]) by smtp.googlemail.com with ESMTPSA id uo6sm4515020wjc.1.2015.09.17.10.30.23 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 17 Sep 2015 10:30:24 -0700 (PDT) From: Elias Vanderstuyft To: Dmitry Torokhov Cc: linux-input@vger.kernel.org, linux-api@vger.kernel.org, linux-kernel@vger.kernel.org, Elias Vanderstuyft Subject: [PATCH 2/2] Input: uinput: Sanity check on ff_effects_max and EV_FF Date: Thu, 17 Sep 2015 19:29:48 +0200 Message-Id: <1442510988-3164-3-git-send-email-elias.vds@gmail.com> X-Mailer: git-send-email 1.9.3 In-Reply-To: <1442510988-3164-1-git-send-email-elias.vds@gmail.com> References: <1442510988-3164-1-git-send-email-elias.vds@gmail.com> Sender: linux-input-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-input@vger.kernel.org X-Spam-Status: No, score=-6.8 required=5.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, FREEMAIL_FROM, RCVD_IN_DNSWL_HI, T_DKIM_INVALID, T_RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Currently the user can specify a non-zero value for ff_effects_max, without setting the EV_FF bit. Inversely, the user can also set ff_effects_max to zero with the EV_FF bit set, in this case the uninitialized method ff->upload can be dereferenced, resulting in a kernel oops. Instead of adding a check in uinput_create_device() and omitting setup of ff-core infrastructure silently in case the check fails, perform the check early in uinput_setup_device(), and print a helpful message and return -EINVAL in case the check fails. Signed-off-by: Elias Vanderstuyft --- drivers/input/misc/uinput.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c index 345df9b..3a90a16 100644 --- a/drivers/input/misc/uinput.c +++ b/drivers/input/misc/uinput.c @@ -393,6 +393,21 @@ static int uinput_setup_device(struct uinput_device *udev, if (IS_ERR(user_dev)) return PTR_ERR(user_dev); + if (!!user_dev->ff_effects_max ^ test_bit(EV_FF, dev->evbit)) { + if (user_dev->ff_effects_max) + printk(KERN_DEBUG + "%s: ff_effects_max (%u) should be zero " + "when FF_BIT is not set\n", + UINPUT_NAME, user_dev->ff_effects_max); + else + printk(KERN_DEBUG + "%s: ff_effects_max should be non-zero " + "when FF_BIT is set\n", + UINPUT_NAME); + retval = -EINVAL; + goto exit; + } + udev->ff_effects_max = user_dev->ff_effects_max; /* Ensure name is filled in */