Unverified Commit 0d29fbb6 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!4067 fix CVE-2022-48619 

Merge Pull Request from: @ci-robot 
 
PR sync from: Liao Chen <liaochen4@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/ZXTVV4KXIG6QKENGX4BBYOBGSZSRTJSE/ 
fix CVE-2022-48619

Jeff LaBundy (1):
  Input: add bounds checking to input_set_capability()


-- 
2.34.1
 
https://gitee.com/src-openeuler/kernel/issues/I8VRD1 
 
Link:https://gitee.com/openeuler/kernel/pulls/4067

 

Reviewed-by: default avatarZhang Jianhua <chris.zjh@huawei.com>
Reviewed-by: default avatarLiu YongQiang <liuyongqiang13@huawei.com>
Signed-off-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
parents 81353187 217d499c

drivers/input/input.c

+19 −0
Original line number Diff line number Diff line
@@ -50,6 +50,17 @@ static DEFINE_MUTEX(input_mutex); 


static const struct input_value input_value_sync = { EV_SYN, SYN_REPORT, 1 };



static const unsigned int input_max_code[EV_CNT] = {

	[EV_KEY] = KEY_MAX,

	[EV_REL] = REL_MAX,

	[EV_ABS] = ABS_MAX,

	[EV_MSC] = MSC_MAX,

	[EV_SW] = SW_MAX,

	[EV_LED] = LED_MAX,

	[EV_SND] = SND_MAX,

	[EV_FF] = FF_MAX,

};



static inline int is_event_supported(unsigned int code,

				     unsigned long *bm, unsigned int max)

{
@@ -1915,6 +1926,14 @@ EXPORT_SYMBOL(input_free_device); 
 */

void input_set_capability(struct input_dev *dev, unsigned int type, unsigned int code)

{

	if (type < EV_CNT && input_max_code[type] &&

	    code > input_max_code[type]) {

		pr_err("%s: invalid code %u for type %u\n", __func__, code,

		       type);

		dump_stack();

		return;

	}



	switch (type) {

	case EV_KEY:

		__set_bit(code, dev->keybit);