Skip to contentSkip to conversation

Input: add bounds checking to input_set_capability()

PATCH Applied Jeff LaBundy 2 participants 2 messages Mar 20, 2022 – Mar 21, 2022

Subsystems (2)
HID Input drivers
lore
Share & tools
lore

Jeff LaBundy

author
#0 lore raw

PATCH 1/1 Input: add bounds checking to input_set_capability()

Update input_set_capability() to prevent kernel panic in case the event code exceeds the bitmap for the given event type.

Suggested-by Tomasz Moń <[email protected]>
Signed-off-by Jeff LaBundy <[email protected]>
Reviewed-by Tomasz Moń <[email protected]>
---
 drivers/input/input.c | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)
drivers/input/input.c +19 -0
index 7c7e4042ec10..6428cdacf534 100644
@@ -47,6 +47,17 @@ static DEFINE_MUTEX(input_mutex);
 
 static const struct input_value input_value_sync = { EV_SYN, SYN_REPORT, 1 };
 
+static const unsigned int input_max_code[EV_CNT] = {
+	[EV_KEY] = KEY_MAX,
+	[EV_REL] = REL_MAX,
+	[EV_ABS] = ABS_MAX,
+	[EV_MSC] = MSC_MAX,
+	[EV_SW] = SW_MAX,
+	[EV_LED] = LED_MAX,
+	[EV_SND] = SND_MAX,
+	[EV_FF] = FF_MAX,
+};
+
 static inline int is_event_supported(unsigned int code,
 				     unsigned long *bm, unsigned int max)
 {

@@ -2110,6 +2121,14 @@ EXPORT_SYMBOL(input_get_timestamp);
  */
 void input_set_capability(struct input_dev *dev, unsigned int type, unsigned int code)
 {
+	if (type < EV_CNT && input_max_code[type] &&
+	    code > input_max_code[type]) {
+		pr_err("%s: invalid code %u for type %u\n", __func__, code,
+		       type);
+		dump_stack();
+		return;
+	}
+
 	switch (type) {
 	case EV_KEY:
 		__set_bit(code, dev->keybit);
Signature · 1 line
2.25.1