Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 95f51a3d authored by Mark Salyzyn's avatar Mark Salyzyn
Browse files

Revert "ANDROID: input: keychord: Fix a slab out-of-bounds read." 

This reverts commit 92fc7f9a.

Remove keychord driver, replaced in user space by
https://android-review.googlesource.com/c/677629

.

Signed-off-by: default avatarMark Salyzyn <salyzyn@google.com>
Cc: Amit Pundir <amit.pundir@linaro.org>
Bug: 64114943
Bug: 63962952
Bug: 129556081
Change-Id: I0a652b72b0ee62974c408ffb0987cc2ef9e346c1
parent 24ff05e7

drivers/input/misc/keychord.c

+6 −22
Original line number Diff line number Diff line
@@ -232,11 +232,9 @@ static ssize_t keychord_write(struct file *file, const char __user *buffer, 
{

	struct keychord_device *kdev = file->private_data;

	struct input_keychord *keychords = 0;

	struct input_keychord *keychord;

	struct input_keychord *keychord, *next, *end;

	int ret, i, key;

	unsigned long flags;

	size_t resid = count;

	size_t key_bytes;



	if (count < sizeof(struct input_keychord) || count > PAGE_SIZE)

		return -EINVAL;
@@ -267,29 +265,15 @@ static ssize_t keychord_write(struct file *file, const char __user *buffer, 
	kdev->head = kdev->tail = 0;



	keychord = keychords;

	end = (struct input_keychord *)((char *)keychord + count);



	while (resid > 0) {

		/* Is the entire keychord entry header present ? */

		if (resid < sizeof(struct input_keychord)) {

			pr_err("keychord: Insufficient bytes present for header %zu\n",

			       resid);

			goto err_unlock_return;

		}

		resid -= sizeof(struct input_keychord);

		if (keychord->count <= 0) {

	while (keychord < end) {

		next = NEXT_KEYCHORD(keychord);

		if (keychord->count <= 0 || next > end) {

			pr_err("keychord: invalid keycode count %d\n",

				keychord->count);

			goto err_unlock_return;

		}

		key_bytes = keychord->count * sizeof(keychord->keycodes[0]);

		/* Do we have all the expected keycodes ? */

		if (resid < key_bytes) {

			pr_err("keychord: Insufficient bytes present for keycount %zu\n",

			       resid);

			goto err_unlock_return;

		}

		resid -= key_bytes;



		if (keychord->version != KEYCHORD_VERSION) {

			pr_err("keychord: unsupported version %d\n",

				keychord->version);
@@ -308,7 +292,7 @@ static ssize_t keychord_write(struct file *file, const char __user *buffer, 
		}



		kdev->keychord_count++;

		keychord = NEXT_KEYCHORD(keychord);

		keychord = next;

	}



	kdev->keychords = keychords;