kernel-fxtec-pro1x/drivers/input
Dan Carpenter 05be8b81aa Input: force feedback - potential integer wrap in input_ff_create()
The problem here is that max_effects can wrap on 32 bits systems.
We'd allocate a smaller amount of data than sizeof(struct ff_device).
The call to kcalloc() on the next line would fail but it would write
the NULL return outside of the memory we just allocated causing data
corruption.

The call path is that uinput_setup_device() get ->ff_effects_max from
the user and sets the value in the ->private_data struct.  From there
it is:
-> uinput_ioctl_handler()
   -> uinput_create_device()
      -> input_ff_create(dev, udev->ff_effects_max);

I've also changed ff_effects_max so it's an unsigned int instead of
a signed int as a cleanup.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
2011-10-12 21:13:11 -07:00
..
gameport i8253: Create linux/i8253.h and use it in all 8253 related files 2011-06-09 15:01:37 +02:00
joystick Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input 2011-08-24 09:19:03 -07:00
keyboard Input: lm8323 - wrap suspend and resume in CONFIG_PM_SLEEP 2011-10-06 19:43:09 -07:00
misc Input: mma8450 - silence some 'uninitialized variable' warnings 2011-10-06 19:41:57 -07:00
mouse Input: psmouse - switch to using dev_*() for messages 2011-10-10 18:28:16 -07:00
serio Input: serio_raw - fix memory leak when closing char device 2011-10-10 18:35:23 -07:00
tablet Input: wacom - correct max Y value on medium bamboos 2011-10-10 08:55:37 -07:00
touchscreen Input: tsc2007 - make sure that X plate resistance is specified 2011-10-11 20:56:41 -07:00
apm-power.c Input: use pr_fmt and pr_<level> 2010-11-30 23:10:26 -08:00
evbug.c Input: use pr_fmt and pr_<level> 2010-11-30 23:10:26 -08:00
evdev.c Input: evdev - try to wake up readers only if we have full packet 2011-06-18 02:54:02 -07:00
ff-core.c Input: force feedback - potential integer wrap in input_ff_create() 2011-10-12 21:13:11 -07:00
ff-memless.c Input: use pr_fmt and pr_<level> 2010-11-30 23:10:26 -08:00
fixp-arith.h
input-compat.c
input-compat.h arch/tile: finish enabling support for TILE-Gx 64-bit chip 2011-05-12 15:52:12 -04:00
input-mt.c Input: add BTN_TOOL_QUINTTAP for reporting 5 fingers on touchpad 2011-08-23 23:08:29 -07:00
input-polldev.c Input: polldev - immediately poll device upon opening 2011-08-09 01:32:45 -07:00
input.c Input: properly assign return value of clamp() macro. 2011-05-25 09:24:58 -07:00
joydev.c Input: remove useless synchronize_rcu() calls 2011-05-12 08:28:57 -07:00
Kconfig Input: xen-kbdfront - move to drivers/input/misc 2011-03-16 23:26:01 -07:00
Makefile Input: xen-kbdfront - move to drivers/input/misc 2011-03-16 23:26:01 -07:00
mousedev.c Input: properly assign return value of clamp() macro. 2011-05-25 09:24:58 -07:00
sparse-keymap.c Input: sparse-keymap - report KEY_UNKNOWN for unknown scan codes 2011-03-28 23:34:52 -07:00