nslots is derived from the ABS_MT_SLOT maximum reported by the virtio device. A device could report a bogus maximum (e.g. -1) making nslots = 0, which input_mt_init_slots() does not reject; it returns success without allocating any slot storage, silently leaving the device registered as multitouch capable with no backing state. Reject non-positive slot counts before calling input_mt_init_slots().
Assisted-by: gkh_clanker:t1000 Signed-off-by: Hari Mishal <[email protected]> --- drivers/virtio/virtio_input.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/virtio/virtio_input.c b/drivers/virtio/virtio_input.c index deec24e8e682..2cc19782cdd3 100644 --- a/drivers/virtio/virtio_input.c +++ b/drivers/virtio/virtio_input.c @@ -312,6 +312,10 @@ static int virtinput_probe(struct virtio_device *vdev) if (test_bit(ABS_MT_SLOT, vi->idev->absbit)) { nslots = input_abs_get_max(vi->idev, ABS_MT_SLOT) + 1; + if (nslots <= 0) { + err = -EINVAL; + goto err_mt_init_slots; + } err = input_mt_init_slots(vi->idev, nslots, 0); if (err) goto err_mt_init_slots; -- 2.43.0
