Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 88438fde authored by Dan Carpenter's avatar Dan Carpenter Committed by Greg Kroah-Hartman
Browse files

Input: joydev - prevent potential read overflow in ioctl 



commit 182d679b2298d62bf42bb14b12a8067b8e17b617 upstream.

The problem here is that "len" might be less than "joydev->nabs" so the
loops which verfy abspam[i] and keypam[] might read beyond the buffer.

Fixes: 999b874f ("Input: joydev - validate axis/button maps before clobbering current ones")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/YCyzR8WvFRw4HWw6@mwanda


[dtor: additional check for len being even in joydev_handle_JSIOCSBTNMAP]
Cc: stable@vger.kernel.org
Signed-off-by: default avatarDmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 3096bea3

drivers/input/joydev.c

+5 −2
Original line number Diff line number Diff line
@@ -460,7 +460,7 @@ static int joydev_handle_JSIOCSAXMAP(struct joydev *joydev, 
	if (IS_ERR(abspam))

		return PTR_ERR(abspam);



	for (i = 0; i < joydev->nabs; i++) {

	for (i = 0; i < len && i < joydev->nabs; i++) {

		if (abspam[i] > ABS_MAX) {

			retval = -EINVAL;

			goto out;
@@ -484,6 +484,9 @@ static int joydev_handle_JSIOCSBTNMAP(struct joydev *joydev, 
	int i;

	int retval = 0;



	if (len % sizeof(*keypam))

		return -EINVAL;



	len = min(len, sizeof(joydev->keypam));



	/* Validate the map. */
@@ -491,7 +494,7 @@ static int joydev_handle_JSIOCSBTNMAP(struct joydev *joydev, 
	if (IS_ERR(keypam))

		return PTR_ERR(keypam);



	for (i = 0; i < joydev->nkey; i++) {

	for (i = 0; i < (len / 2) && i < joydev->nkey; i++) {

		if (keypam[i] > KEY_MAX || keypam[i] < BTN_MISC) {

			retval = -EINVAL;

			goto out;