| From 182d679b2298d62bf42bb14b12a8067b8e17b617 Mon Sep 17 00:00:00 2001 |
| From: Dan Carpenter <dan.carpenter@oracle.com> |
| Date: Wed, 17 Feb 2021 12:21:10 -0800 |
| Subject: Input: joydev - prevent potential read overflow in ioctl |
| |
| From: Dan Carpenter <dan.carpenter@oracle.com> |
| |
| commit 182d679b2298d62bf42bb14b12a8067b8e17b617 upstream. |
| |
| The problem here is that "len" might be less than "joydev->nabs" so the |
| loops which verfy abspam[i] and keypam[] might read beyond the buffer. |
| |
| Fixes: 999b874f4aa3 ("Input: joydev - validate axis/button maps before clobbering current ones") |
| Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> |
| Link: https://lore.kernel.org/r/YCyzR8WvFRw4HWw6@mwanda |
| [dtor: additional check for len being even in joydev_handle_JSIOCSBTNMAP] |
| Cc: stable@vger.kernel.org |
| Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| drivers/input/joydev.c | 7 +++++-- |
| 1 file changed, 5 insertions(+), 2 deletions(-) |
| |
| --- a/drivers/input/joydev.c |
| +++ b/drivers/input/joydev.c |
| @@ -456,7 +456,7 @@ static int joydev_handle_JSIOCSAXMAP(str |
| if (IS_ERR(abspam)) |
| return PTR_ERR(abspam); |
| |
| - for (i = 0; i < joydev->nabs; i++) { |
| + for (i = 0; i < len && i < joydev->nabs; i++) { |
| if (abspam[i] > ABS_MAX) { |
| retval = -EINVAL; |
| goto out; |
| @@ -480,6 +480,9 @@ static int joydev_handle_JSIOCSBTNMAP(st |
| int i; |
| int retval = 0; |
| |
| + if (len % sizeof(*keypam)) |
| + return -EINVAL; |
| + |
| len = min(len, sizeof(joydev->keypam)); |
| |
| /* Validate the map. */ |
| @@ -487,7 +490,7 @@ static int joydev_handle_JSIOCSBTNMAP(st |
| if (IS_ERR(keypam)) |
| return PTR_ERR(keypam); |
| |
| - for (i = 0; i < joydev->nkey; i++) { |
| + for (i = 0; i < (len / 2) && i < joydev->nkey; i++) { |
| if (keypam[i] > KEY_MAX || keypam[i] < BTN_MISC) { |
| retval = -EINVAL; |
| goto out; |
