diff options
| author | Linux Build Service Account <lnxbuild@localhost> | 2020-08-31 13:09:41 -0700 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2020-08-31 13:09:41 -0700 |
| commit | 4365ffa2db0d9ac58ce06d62aa9b06e3d01ae0a2 (patch) | |
| tree | 65f475ebe5a3859f6cc44b12b602123cdb15e4c0 /drivers/input | |
| parent | 9b93a7d64b0fd6cc5250a121f25ba75296d2b4aa (diff) | |
| parent | 677201b9678c6cf617afc3c0a058919e0ee49e98 (diff) | |
Merge "Input: add safety guards to input_set_keycode()"
Diffstat (limited to 'drivers/input')
| -rw-r--r-- | drivers/input/input.c | 26 |
1 files changed, 16 insertions, 10 deletions
diff --git a/drivers/input/input.c b/drivers/input/input.c index baaddd168804..857917086cb0 100644 --- a/drivers/input/input.c +++ b/drivers/input/input.c @@ -851,16 +851,18 @@ static int input_default_setkeycode(struct input_dev *dev, } } - __clear_bit(*old_keycode, dev->keybit); - __set_bit(ke->keycode, dev->keybit); - - for (i = 0; i < dev->keycodemax; i++) { - if (input_fetch_keycode(dev, i) == *old_keycode) { - __set_bit(*old_keycode, dev->keybit); - break; /* Setting the bit twice is useless, so break */ + if (*old_keycode <= KEY_MAX) { + __clear_bit(*old_keycode, dev->keybit); + for (i = 0; i < dev->keycodemax; i++) { + if (input_fetch_keycode(dev, i) == *old_keycode) { + __set_bit(*old_keycode, dev->keybit); + /* Setting the bit twice is useless, so break */ + break; + } } } + __set_bit(ke->keycode, dev->keybit); return 0; } @@ -916,9 +918,13 @@ int input_set_keycode(struct input_dev *dev, * Simulate keyup event if keycode is not present * in the keymap anymore */ - if (test_bit(EV_KEY, dev->evbit) && - !is_event_supported(old_keycode, dev->keybit, KEY_MAX) && - __test_and_clear_bit(old_keycode, dev->key)) { + if (old_keycode > KEY_MAX) { + dev_warn(dev->dev.parent ?: &dev->dev, + "%s: got too big old keycode %#x\n", + __func__, old_keycode); + } else if (test_bit(EV_KEY, dev->evbit) && + !is_event_supported(old_keycode, dev->keybit, KEY_MAX) && + __test_and_clear_bit(old_keycode, dev->key)) { struct input_value vals[] = { { EV_KEY, old_keycode, 0 }, input_value_sync |