| Message ID | 1347553050-25480-1-git-send-email-dh.herrmann@googlemail.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
Hi Dmitry On Thu, Sep 13, 2012 at 6:17 PM, David Herrmann <dh.herrmann@googlemail.com> wrote: > The "input_table" array is very small and we cannot be sure that the file > the user opens has a minor-ID below 256 (8 << 5). Hence, simply check that > the minor isn't out-of-bounds. If it is, return -ENODEV. > > Signed-off-by: David Herrmann <dh.herrmann@googlemail.com> > Cc: <stable@kernel.org> This should be "Cc: <stable@vger.kernel.org>". Sorry for the typo. Thanks David -- To unsubscribe from this list: send the line "unsubscribe linux-input" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Hi David, On Thu, Sep 13, 2012 at 06:18:17PM +0200, David Herrmann wrote: > Hi Dmitry > > On Thu, Sep 13, 2012 at 6:17 PM, David Herrmann > <dh.herrmann@googlemail.com> wrote: > > The "input_table" array is very small and we cannot be sure that the file > > the user opens has a minor-ID below 256 (8 << 5). Hence, simply check that > > the minor isn't out-of-bounds. If it is, return -ENODEV. > > > > Signed-off-by: David Herrmann <dh.herrmann@googlemail.com> > > Cc: <stable@kernel.org> > > This should be "Cc: <stable@vger.kernel.org>". Sorry for the typo. register_chrdev() reserves exactly 256 minors so it is not possible for input_open_file() to be called with minor that will get us out of bounds. Thanks.
Hi Dmitry On Thu, Sep 13, 2012 at 6:57 PM, Dmitry Torokhov <dmitry.torokhov@gmail.com> wrote: > Hi David, > > On Thu, Sep 13, 2012 at 06:18:17PM +0200, David Herrmann wrote: >> Hi Dmitry >> >> On Thu, Sep 13, 2012 at 6:17 PM, David Herrmann >> <dh.herrmann@googlemail.com> wrote: >> > The "input_table" array is very small and we cannot be sure that the file >> > the user opens has a minor-ID below 256 (8 << 5). Hence, simply check that >> > the minor isn't out-of-bounds. If it is, return -ENODEV. >> > >> > Signed-off-by: David Herrmann <dh.herrmann@googlemail.com> >> > Cc: <stable@kernel.org> >> >> This should be "Cc: <stable@vger.kernel.org>". Sorry for the typo. > > register_chrdev() reserves exactly 256 minors so it is not possible for > input_open_file() to be called with minor that will get us out of > bounds. Ah, magic numbers. I love them! But thanks, good to know, as I am currently working on integrating dynamic-minors. Sorry for the noise. Regards David -- To unsubscribe from this list: send the line "unsubscribe linux-input" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/drivers/input/input.c b/drivers/input/input.c index 8921c61..eb65ad7 100644 --- a/drivers/input/input.c +++ b/drivers/input/input.c @@ -2095,13 +2095,19 @@ static int input_open_file(struct inode *inode, struct file *file) struct input_handler *handler; const struct file_operations *old_fops, *new_fops = NULL; int err; + unsigned int minor_group; err = mutex_lock_interruptible(&input_mutex); if (err) return err; /* No load-on-demand here? */ - handler = input_table[iminor(inode) >> 5]; + + minor_group = iminor(inode) >> 5; + if (minor_group >= sizeof(input_table) / sizeof(*input_table)) + return -ENODEV; + + handler = input_table[minor_group]; if (handler) new_fops = fops_get(handler->fops);
The "input_table" array is very small and we cannot be sure that the file the user opens has a minor-ID below 256 (8 << 5). Hence, simply check that the minor isn't out-of-bounds. If it is, return -ENODEV. Signed-off-by: David Herrmann <dh.herrmann@googlemail.com> Cc: <stable@kernel.org> --- drivers/input/input.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)