diff options
| author | Dmitry Torokhov <dmitry.torokhov@gmail.com> | 2019-12-13 14:56:16 -0800 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2020-08-28 01:21:24 -0700 |
| commit | 677201b9678c6cf617afc3c0a058919e0ee49e98 (patch) | |
| tree | 6822f424c908ea7d7fefae3b1183084b0a981f2a /kernel/locking/spinlock_debug.c | |
| parent | 02e8ec9605d2e2a5dee7c46a73a77df53d5ce66d (diff) | |
Input: add safety guards to input_set_keycode()
If we happen to have a garbage in input device's keycode table with values
too big we'll end up doing clear_bit() with offset way outside of our
bitmaps, damaging other objects within an input device or even outside of
it. Let's add sanity checks to the returned old keycodes.
Reported-by: syzbot+c769968809f9359b07aa@syzkaller.appspotmail.com
Reported-by: syzbot+76f3a30e88d256644c78@syzkaller.appspotmail.com
Link: https://lore.kernel.org/r/20191207212757.GA245964@dtor-ws
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Git-commit: cb222aed03d798fc074be55e59d9a112338ee784
Change-Id: I1bd01ea3ffa0ba0e0303d19cfcc27cc39947963b
Signed-off-by: Alam Md Danish <amddan@codeaurora.org>
Signed-off-by: Rahul Shahare <rshaha@codeaurora.org>
Diffstat (limited to 'kernel/locking/spinlock_debug.c')
0 files changed, 0 insertions, 0 deletions