Input: force feedback - potential integer wrap in input_ff_create()

The problem here is that max_effects can wrap on 32 bits systems.
We'd allocate a smaller amount of data than sizeof(struct ff_device).
The call to kcalloc() on the next line would fail but it would write
the NULL return outside of the memory we just allocated causing data
corruption.

The call path is that uinput_setup_device() get ->ff_effects_max from
the user and sets the value in the ->private_data struct.  From there
it is:
-> uinput_ioctl_handler()
   -> uinput_create_device()
      -> input_ff_create(dev, udev->ff_effects_max);

I've also changed ff_effects_max so it's an unsigned int instead of
a signed int as a cleanup.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>

diff --git a/drivers/input/ff-core.c b/drivers/input/ff-core.c
index 3367f760d75ad0778298d00615b2dde86d9b871a..480eb9d9876a57a79f4b7b5c599aa38db909faea 100644 (file)
--- a/drivers/input/ff-core.c
+++ b/drivers/input/ff-core.c
@@ -309,9 +309,10 @@ EXPORT_SYMBOL_GPL(input_ff_event);
  * Once ff device is created you need to setup its upload, erase,
  * playback and other handlers before registering input device
  */
-int input_ff_create(struct input_dev *dev, int max_effects)
+int input_ff_create(struct input_dev *dev, unsigned int max_effects)
 {
        struct ff_device *ff;
+       size_t ff_dev_size;
        int i;
 
        if (!max_effects) {
@@ -319,8 +320,12 @@ int input_ff_create(struct input_dev *dev, int max_effects)
                return -EINVAL;
        }
 
-       ff = kzalloc(sizeof(struct ff_device) +
-                    max_effects * sizeof(struct file *), GFP_KERNEL);
+       ff_dev_size = sizeof(struct ff_device) +
+                               max_effects * sizeof(struct file *);
+       if (ff_dev_size < max_effects) /* overflow */
+               return -EINVAL;
+
+       ff = kzalloc(ff_dev_size, GFP_KERNEL);
        if (!ff)
                return -ENOMEM;
 

diff --git a/include/linux/input.h b/include/linux/input.h
index 57add325e7a85a99591dfae1b75f90c422e15520..6d5eddb18c8210191ea2fd459371099f4a576059 100644 (file)
--- a/include/linux/input.h
+++ b/include/linux/input.h
@@ -1610,7 +1610,7 @@ struct ff_device {
        struct file *effect_owners[];
 };
 
-int input_ff_create(struct input_dev *dev, int max_effects);
+int input_ff_create(struct input_dev *dev, unsigned int max_effects);
 void input_ff_destroy(struct input_dev *dev);
 
 int input_ff_event(struct input_dev *dev, unsigned int type, unsigned int code, int value);

diff --git a/include/linux/uinput.h b/include/linux/uinput.h
index d28c726ede4f738680eedebc2944f0f73d698aa5..2aa2881b0df98a6faaee25917da8b9d499c533c7 100644 (file)
--- a/include/linux/uinput.h
+++ b/include/linux/uinput.h
@@ -68,7 +68,7 @@ struct uinput_device {
        unsigned char           head;
        unsigned char           tail;
        struct input_event      buff[UINPUT_BUFFER_SIZE];
-       int                     ff_effects_max;
+       unsigned int            ff_effects_max;
 
        struct uinput_request   *requests[UINPUT_NUM_REQUESTS];
        wait_queue_head_t       requests_waitq;