| Message ID | 20170131231728.GA37933@dtor-ws (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
On Jan 31 2017 or thereabouts, Dmitry Torokhov wrote: > If user tries to initialize uinput device mixing old and new style > initialization (i.e. using old UI_SET_ABSBIT instead of UI_ABS_SETUP, > we forget to allocate input->absinfo and will crash when trying to send > absolute events: > > ioctl(ui, UI_DEV_SETUP, &us); > ioctl(ui, UI_SET_EVBIT, EV_ABS); > ioctl(ui, UI_SET_ABSBIT, ABS_X); > ioctl(ui, UI_SET_ABSBIT, ABS_Y); > ioctl(ui, UI_DEV_CREATE, 0); Shouldn't we prevent completely the mix of the 2 versions? If the user used UI_DEV_SETUP, we should probably prevent the use of UI_SET_ABSBIT afterwards, or at least warn it somehow. But the patch in itself doesn't hurt, so: Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Cheers, Benjamin > > Reported-by: Rodrigo Rivas Costa <rodrigorivascosta@gmail.com> > Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=191811 > Fixes: fbae10db0940 ("Input: uinput - rework ABS validation") > Cc: stable@vger.kernel.org > Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> > --- > drivers/input/misc/uinput.c | 20 ++++++++++++++------ > 1 file changed, 14 insertions(+), 6 deletions(-) > > diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c > index 92595b98e7ed..022be0e22eba 100644 > --- a/drivers/input/misc/uinput.c > +++ b/drivers/input/misc/uinput.c > @@ -263,13 +263,21 @@ static int uinput_create_device(struct uinput_device *udev) > return -EINVAL; > } > > - if (test_bit(ABS_MT_SLOT, dev->absbit)) { > - nslot = input_abs_get_max(dev, ABS_MT_SLOT) + 1; > - error = input_mt_init_slots(dev, nslot, 0); > - if (error) > + if (test_bit(EV_ABS, dev->evbit)) { > + input_alloc_absinfo(dev); > + if (!dev->absinfo) { > + error = -EINVAL; > goto fail1; > - } else if (test_bit(ABS_MT_POSITION_X, dev->absbit)) { > - input_set_events_per_packet(dev, 60); > + } > + > + if (test_bit(ABS_MT_SLOT, dev->absbit)) { > + nslot = input_abs_get_max(dev, ABS_MT_SLOT) + 1; > + error = input_mt_init_slots(dev, nslot, 0); > + if (error) > + goto fail1; > + } else if (test_bit(ABS_MT_POSITION_X, dev->absbit)) { > + input_set_events_per_packet(dev, 60); > + } > } > > if (test_bit(EV_FF, dev->evbit) && !udev->ff_effects_max) { > -- > 2.11.0.483.g087da7b7c-goog > > -- > Dmitry -- To unsubscribe from this list: send the line "unsubscribe linux-input" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On Wed, Feb 01, 2017 at 09:49:25AM +0100, Benjamin Tissoires wrote: > On Jan 31 2017 or thereabouts, Dmitry Torokhov wrote: > > If user tries to initialize uinput device mixing old and new style > > initialization (i.e. using old UI_SET_ABSBIT instead of UI_ABS_SETUP, > > we forget to allocate input->absinfo and will crash when trying to send > > absolute events: > > > > ioctl(ui, UI_DEV_SETUP, &us); > > ioctl(ui, UI_SET_EVBIT, EV_ABS); > > ioctl(ui, UI_SET_ABSBIT, ABS_X); > > ioctl(ui, UI_SET_ABSBIT, ABS_Y); > > ioctl(ui, UI_DEV_CREATE, 0); > > Shouldn't we prevent completely the mix of the 2 versions? If the user > used UI_DEV_SETUP, we should probably prevent the use of UI_SET_ABSBIT > afterwards, or at least warn it somehow. Why? If user does not wish to set up parameters of an axis then just using UI_SET_ABSBIT is fine. In fact, I think it would be weird if we allowed all UI_SET_*BIT except for ABS. > > But the patch in itself doesn't hurt, so: > Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Thanks.
diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c index 92595b98e7ed..022be0e22eba 100644 --- a/drivers/input/misc/uinput.c +++ b/drivers/input/misc/uinput.c @@ -263,13 +263,21 @@ static int uinput_create_device(struct uinput_device *udev) return -EINVAL; } - if (test_bit(ABS_MT_SLOT, dev->absbit)) { - nslot = input_abs_get_max(dev, ABS_MT_SLOT) + 1; - error = input_mt_init_slots(dev, nslot, 0); - if (error) + if (test_bit(EV_ABS, dev->evbit)) { + input_alloc_absinfo(dev); + if (!dev->absinfo) { + error = -EINVAL; goto fail1; - } else if (test_bit(ABS_MT_POSITION_X, dev->absbit)) { - input_set_events_per_packet(dev, 60); + } + + if (test_bit(ABS_MT_SLOT, dev->absbit)) { + nslot = input_abs_get_max(dev, ABS_MT_SLOT) + 1; + error = input_mt_init_slots(dev, nslot, 0); + if (error) + goto fail1; + } else if (test_bit(ABS_MT_POSITION_X, dev->absbit)) { + input_set_events_per_packet(dev, 60); + } } if (test_bit(EV_FF, dev->evbit) && !udev->ff_effects_max) {
If user tries to initialize uinput device mixing old and new style initialization (i.e. using old UI_SET_ABSBIT instead of UI_ABS_SETUP, we forget to allocate input->absinfo and will crash when trying to send absolute events: ioctl(ui, UI_DEV_SETUP, &us); ioctl(ui, UI_SET_EVBIT, EV_ABS); ioctl(ui, UI_SET_ABSBIT, ABS_X); ioctl(ui, UI_SET_ABSBIT, ABS_Y); ioctl(ui, UI_DEV_CREATE, 0); Reported-by: Rodrigo Rivas Costa <rodrigorivascosta@gmail.com> Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=191811 Fixes: fbae10db0940 ("Input: uinput - rework ABS validation") Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> --- drivers/input/misc/uinput.c | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-)