The "input_table" array is very small and we cannot be sure that the file the user opens has a minor-ID below 256 (8 << 5). Hence, simply check that the minor isn't out-of-bounds. If it is, return -ENODEV.
Signed-off-by: David Herrmann <[email protected]> Cc: <[email protected]> --- drivers/input/input.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/input/input.c b/drivers/input/input.c index 8921c61..eb65ad7 100644 --- a/drivers/input/input.c +++ b/drivers/input/input.c @@ -2095,13 +2095,19 @@ static int input_open_file(struct inode *inode, struct file *file) struct input_handler *handler; const struct file_operations *old_fops, *new_fops = NULL; int err; + unsigned int minor_group; err = mutex_lock_interruptible(&input_mutex); if (err) return err; /* No load-on-demand here? */ - handler = input_table[iminor(inode) >> 5]; + + minor_group = iminor(inode) >> 5; + if (minor_group >= sizeof(input_table) / sizeof(*input_table)) + return -ENODEV; + + handler = input_table[minor_group]; if (handler) new_fops = fops_get(handler->fops); -- 1.7.12 -- To unsubscribe from this list: send the line "unsubscribe linux-input" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html
