kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-22 19:14:51 +00:00
Code Issues Releases Packages Activity
linux/drivers/input/misc
History
Dmitry Torokhov 61df76619e Input: uinput - reject requests with unreasonable number of slots 
[ Upstream commit 206f533a0a ]

From: Dmitry Torokhov <dmitry.torokhov@gmail.com>

When exercising uinput interface syzkaller may try setting up device
with a really large number of slots, which causes memory allocation
failure in input_mt_init_slots(). While this allocation failure is
handled properly and request is rejected, it results in syzkaller
reports. Additionally, such request may put undue burden on the
system which will try to free a lot of memory for a bogus request.

Fix it by limiting allowed number of slots to 100. This can easily
be extended if we see devices that can track more than 100 contacts.

Reported-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Reported-by: syzbot <syzbot+0122fa359a69694395d5@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=0122fa359a69694395d5
Link: https://lore.kernel.org/r/Zqgi7NYEbpRsJfa2@google.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2024-09-12 11:10:25 +02:00
..
88pm80x_onkey.c Input: remove dev_err() usage after platform_get_irq() 2019-08-14 10:49:01 -07:00
88pm860x_onkey.c Input: remove dev_err() usage after platform_get_irq() 2019-08-14 10:49:01 -07:00
ab8500-ponkey.c Input: ab8500-ponkey - fix incorrect name in 'ab8500_ponkey' doc header 2020-11-08 22:27:54 -08:00
ad714x-i2c.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 149 2019-05-30 11:25:18 -07:00
ad714x-spi.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 149 2019-05-30 11:25:18 -07:00
ad714x.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 149 2019-05-30 11:25:18 -07:00
ad714x.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 149 2019-05-30 11:25:18 -07:00
adxl34x-i2c.c i2c: Make remove callback return void 2022-08-16 12:46:26 +02:00
adxl34x-spi.c spi: make remove callback a void function 2022-02-09 13:00:45 +00:00
adxl34x.c Input: adxl34x - do not hardcode interrupt trigger type 2023-07-19 16:21:17 +02:00
adxl34x.h Input: adxl34x - make adxl34x_remove() return void 2021-10-12 19:48:52 -07:00
apanel.c Input: apanel - switch to using polled mode of input devices 2019-10-29 17:14:14 -07:00
ariel-pwrbutton.c Input: ariel-pwrbutton - add SPI device ID table 2021-10-01 21:24:14 -07:00
arizona-haptics.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
atc260x-onkey.c input: atc260x: Add onkey driver for ATC260x PMICs 2021-03-10 11:10:30 +00:00
ati_remote2.c Input: remove third argument of usb_maxpacket() 2022-04-23 10:33:53 +02:00
atlas_btns.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
atmel_captouch.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 282 2019-06-05 17:36:37 +02:00
axp20x-pek.c Linux 5.16 2022-01-17 18:03:39 -08:00
bma150.c i2c: Make remove callback return void 2022-08-16 12:46:26 +02:00
cm109.c Input: remove third argument of usb_maxpacket() 2022-04-23 10:33:53 +02:00
cma3000_d0x.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 234 2019-06-19 17:09:07 +02:00
cma3000_d0x.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 234 2019-06-19 17:09:07 +02:00
cma3000_d0x_i2c.c i2c: Make remove callback return void 2022-08-16 12:46:26 +02:00
cobalt_btns.c Input: cobalt_btns - switch to using polled mode of input devices 2019-10-29 17:14:17 -07:00
cpcap-pwrbutton.c Input: cpcap-pwrbutton - do not set input parent explicitly 2021-10-16 18:51:02 -07:00
da7280.c Input: da7280 - protect OF match table with CONFIG_OF 2020-12-18 10:04:34 -08:00
da9052_onkey.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
da9055_onkey.c Input: remove dev_err() usage after platform_get_irq() 2019-08-14 10:49:01 -07:00
da9063_onkey.c Input: da9063 - use devm_delayed_work_autocancel() 2022-02-28 23:31:24 -08:00
dm355evm_keys.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
drv260x.c Input: drv260x - sleep between polling GO bit 2023-07-19 16:21:14 +02:00
drv2665.c Input: use input_device_enabled() 2020-12-02 22:10:33 -08:00
drv2667.c Input: use input_device_enabled() 2020-12-02 22:10:33 -08:00
e3x0-button.c Input: remove dev_err() usage after platform_get_irq() 2019-08-14 10:49:01 -07:00
gpio-beeper.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
gpio-vibra.c Input: add a driver for GPIO controllable vibrators 2019-04-30 00:11:25 -07:00
gpio_decoder.c treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_30.RULE (part 2) 2022-06-10 14:51:35 +02:00
hisi_powerkey.c Input: remove dev_err() usage after platform_get_irq() 2019-08-14 10:49:01 -07:00
hp_sdc_rtc.c Input: hp_sdc_rtc - remove dead chardev code 2019-10-23 15:56:08 -07:00
ibm-panel.c Input: ibm-panel - add missing MODULE_DEVICE_TABLE 2022-09-28 09:04:32 -07:00
ideapad_slidebar.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
ims-pcu.c Input: ims-pcu - fix printf string overflow 2024-06-12 11:03:44 +02:00
iqs269a.c Input: Use fallthrough pseudo-keyword 2020-07-07 11:25:54 -07:00
iqs626a.c Input: iqs626a - prohibit inlining of channel parsing functions 2021-11-28 23:59:35 -08:00
iqs7222.c Input: iqs7222 - configure power mode before triggering ATI 2023-09-19 12:27:59 +02:00
Kconfig Input: wistron_btns - disable on UML 2022-12-31 13:32:19 +01:00
keyspan_remote.c Input: move from strlcpy with unused retval to strscpy 2022-08-18 15:44:08 -07:00
kxtj9.c Input: use input_device_enabled() 2020-12-02 22:10:33 -08:00
m68kspkr.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
Makefile Input: rt5120 - add power key support 2022-08-31 15:48:49 -07:00
max8925_onkey.c Input: max8925_onkey - don't mark comment as kernel-doc 2021-10-15 22:10:33 -07:00
max8997_haptic.c Input: max8997 - simplify open coding of a division using up to 64 divisions 2021-03-25 11:14:08 -07:00
max77650-onkey.c Input: max77650-onkey - add of_match table 2020-01-16 20:23:24 -08:00
max77693-haptic.c Input: max77693-haptic - drop unneeded MODULE_ALIAS 2021-10-16 21:18:30 -07:00
mc13783-pwrbutton.c Input: mc13783-pwrbutton - file headers are not good candidates for kernel-doc 2020-11-19 19:18:22 -08:00
mma8450.c Input: mma8450 - switch to using polled mode of input devices 2019-10-29 17:15:48 -07:00
palmas-pwrbutton.c treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_320.RULE 2022-06-10 14:51:36 +02:00
pcap_keys.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
pcf8574_keypad.c i2c: Make remove callback return void 2022-08-16 12:46:26 +02:00
pcf50633-input.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
pcspkr.c Input: pcspkr - fix fall-through warnings for Clang 2020-11-22 22:16:21 -08:00
pm8xxx-vibrator.c Input: pm8xxx-vibrator - correct VIB_MAX_LEVELS calculation 2024-06-12 11:03:45 +02:00
pm8941-pwrkey.c Input: pm8941-powerkey - fix debounce on gen2+ PMICs 2023-07-19 16:21:26 +02:00
pmic8xxx-pwrkey.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 284 2019-06-05 17:36:37 +02:00
powermate.c Input: powermate - fix use-after-free in powermate_config_complete 2023-10-19 23:08:57 +02:00
pwm-beeper.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 151 2019-05-30 11:26:28 -07:00
pwm-vibra.c Input: Use fallthrough pseudo-keyword 2020-07-07 11:25:54 -07:00
rave-sp-pwrbutton.c Input: add RAVE SP Powerbutton driver 2018-03-08 15:34:45 -08:00
rb532_button.c Input: rb532_button - switch to using polled mode of input devices 2019-10-29 17:15:46 -07:00
regulator-haptic.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
retu-pwrbutton.c Input: misc - drop empty remove functions 2017-01-21 23:53:34 -08:00
rk805-pwrkey.c Input: rk805-pwrkey - fix module autoloading 2022-08-22 16:59:49 -07:00
rotary_encoder.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
rt5120-pwrkey.c Input: rt5120 - add power key support 2022-08-31 15:48:49 -07:00
sc27xx-vibra.c Input: sc27xx - add support for sc2730 and sc2721 2020-12-11 19:00:21 -08:00
sgi_btns.c Input: sgi_btns - switch to using polled mode of input devices 2019-10-29 17:15:26 -07:00
soc_button_array.c Input: soc_button_array - add mapping for airplane mode button 2024-01-01 12:39:04 +00:00
sparcspkr.c Input: sparcspkr - fix refcount leak in bbc_beep_probe 2022-05-16 21:10:11 -07:00
stpmic1_onkey.c Input: remove dev_err() usage after platform_get_irq() 2019-08-14 10:49:01 -07:00
tps65218-pwrbutton.c treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_320.RULE 2022-06-10 14:51:36 +02:00
twl4030-pwrbutton.c Input: twl4030-pwrbutton - add missing of.h include 2022-09-27 08:43:04 -07:00
twl4030-vibra.c Input: twl4030-vibra - drop legacy, non DT boot support 2022-09-24 22:40:04 -07:00
twl6040-vibra.c Input: remove dev_err() usage after platform_get_irq() 2019-08-14 10:49:01 -07:00
uinput.c Input: uinput - reject requests with unreasonable number of slots 2024-09-12 11:10:25 +02:00
wistron_btns.c Input: wistron_btns - switch to using polled mode of input devices 2019-10-29 17:14:15 -07:00
wm831x-on.c Input: wm831x-on - source file headers are not good candidates for kernel-doc 2020-11-19 19:18:43 -08:00
xen-kbdfront.c xen: switch gnttab_end_foreign_access() to take a struct page pointer 2022-05-27 11:05:29 +02:00
yealink.c Input: remove third argument of usb_maxpacket() 2022-04-23 10:33:53 +02:00
yealink.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00