All of lore.kernel.org
 help / color / mirror / Atom feed
From: Dan Carpenter <dan.carpenter@oracle.com>
To: steve@sk2.org
Cc: linux-input@vger.kernel.org
Subject: re: Input: joydev - validate axis/button maps before clobbering current ones
Date: Tue, 6 Oct 2015 21:51:55 +0300	[thread overview]
Message-ID: <20151006185155.GA8997@mwanda> (raw)

Hello Stephen Kitt,

The patch 999b874f4aa3: "Input: joydev - validate axis/button maps
before clobbering current ones" from Aug 25, 2009, leads to the
following static checker warning:

	drivers/input/joydev.c:466 joydev_handle_JSIOCSAXMAP()
	error: 'abspam' dereferencing possible ERR_PTR()

drivers/input/joydev.c
   437  static int joydev_handle_JSIOCSAXMAP(struct joydev *joydev,
   438                                       void __user *argp, size_t len)
   439  {
   440          __u8 *abspam;
   441          int i;
   442          int retval = 0;
   443  
   444          len = min(len, sizeof(joydev->abspam));
   445  
   446          /* Validate the map. */
   447          abspam = memdup_user(argp, len);
   448          if (IS_ERR(abspam)) {
   449                  retval = PTR_ERR(abspam);
   450                  goto out;

out labels are error prone.  It's safer to return directly.

https://plus.google.com/106378716002406849458/posts/dnanfhQ4mHQ

joydev_handle_JSIOCSBTNMAP() has the same issue.

   451          }
   452  
   453          for (i = 0; i < joydev->nabs; i++) {
   454                  if (abspam[i] > ABS_MAX) {
   455                          retval = -EINVAL;
   456                          goto out;
   457                  }
   458          }
   459  
   460          memcpy(joydev->abspam, abspam, len);
   461  
   462          for (i = 0; i < joydev->nabs; i++)
   463                  joydev->absmap[joydev->abspam[i]] = i;
   464  
   465   out:
   466          kfree(abspam);
   467          return retval;
   468  }

regards,
dan carpenter

             reply	other threads:[~2015-10-06 18:52 UTC|newest]

Thread overview: 9+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2015-10-06 18:51 Dan Carpenter [this message]
2015-10-06 20:57 ` Input: joydev - validate axis/button maps before clobbering current ones Stephen Kitt
2015-10-06 21:01   ` Stephen Kitt
2015-10-06 21:49     ` Javier Martinez Canillas
2015-10-06 22:49       ` Dmitry Torokhov
2015-10-06 23:31         ` Javier Martinez Canillas
2015-10-07  5:46   ` Dan Carpenter
2015-10-07  8:51     ` Javier Martinez Canillas
2015-10-07  9:22       ` Dan Carpenter

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20151006185155.GA8997@mwanda \
    --to=dan.carpenter@oracle.com \
    --cc=linux-input@vger.kernel.org \
    --cc=steve@sk2.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.