* [PATCH] input: fix input_open_file() accessing out-of-bound buffers
@ 2012-09-13 16:17 David Herrmann
2012-09-13 16:18 ` David Herrmann
0 siblings, 1 reply; 4+ messages in thread
From: David Herrmann @ 2012-09-13 16:17 UTC (permalink / raw)
To: linux-input; +Cc: Dmitry Torokhov, David Herrmann, stable
The "input_table" array is very small and we cannot be sure that the file
the user opens has a minor-ID below 256 (8 << 5). Hence, simply check that
the minor isn't out-of-bounds. If it is, return -ENODEV.
Signed-off-by: David Herrmann <dh.herrmann@googlemail.com>
Cc: <stable@kernel.org>
---
drivers/input/input.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/drivers/input/input.c b/drivers/input/input.c
index 8921c61..eb65ad7 100644
--- a/drivers/input/input.c
+++ b/drivers/input/input.c
@@ -2095,13 +2095,19 @@ static int input_open_file(struct inode *inode, struct file *file)
struct input_handler *handler;
const struct file_operations *old_fops, *new_fops = NULL;
int err;
+ unsigned int minor_group;
err = mutex_lock_interruptible(&input_mutex);
if (err)
return err;
/* No load-on-demand here? */
- handler = input_table[iminor(inode) >> 5];
+
+ minor_group = iminor(inode) >> 5;
+ if (minor_group >= sizeof(input_table) / sizeof(*input_table))
+ return -ENODEV;
+
+ handler = input_table[minor_group];
if (handler)
new_fops = fops_get(handler->fops);
--
1.7.12
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH] input: fix input_open_file() accessing out-of-bound buffers
2012-09-13 16:17 [PATCH] input: fix input_open_file() accessing out-of-bound buffers David Herrmann
@ 2012-09-13 16:18 ` David Herrmann
2012-09-13 16:57 ` Dmitry Torokhov
0 siblings, 1 reply; 4+ messages in thread
From: David Herrmann @ 2012-09-13 16:18 UTC (permalink / raw)
To: linux-input; +Cc: Dmitry Torokhov, David Herrmann
Hi Dmitry
On Thu, Sep 13, 2012 at 6:17 PM, David Herrmann
<dh.herrmann@googlemail.com> wrote:
> The "input_table" array is very small and we cannot be sure that the file
> the user opens has a minor-ID below 256 (8 << 5). Hence, simply check that
> the minor isn't out-of-bounds. If it is, return -ENODEV.
>
> Signed-off-by: David Herrmann <dh.herrmann@googlemail.com>
> Cc: <stable@kernel.org>
This should be "Cc: <stable@vger.kernel.org>". Sorry for the typo.
Thanks
David
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] input: fix input_open_file() accessing out-of-bound buffers
2012-09-13 16:18 ` David Herrmann
@ 2012-09-13 16:57 ` Dmitry Torokhov
2012-09-13 17:00 ` David Herrmann
0 siblings, 1 reply; 4+ messages in thread
From: Dmitry Torokhov @ 2012-09-13 16:57 UTC (permalink / raw)
To: David Herrmann; +Cc: linux-input
Hi David,
On Thu, Sep 13, 2012 at 06:18:17PM +0200, David Herrmann wrote:
> Hi Dmitry
>
> On Thu, Sep 13, 2012 at 6:17 PM, David Herrmann
> <dh.herrmann@googlemail.com> wrote:
> > The "input_table" array is very small and we cannot be sure that the file
> > the user opens has a minor-ID below 256 (8 << 5). Hence, simply check that
> > the minor isn't out-of-bounds. If it is, return -ENODEV.
> >
> > Signed-off-by: David Herrmann <dh.herrmann@googlemail.com>
> > Cc: <stable@kernel.org>
>
> This should be "Cc: <stable@vger.kernel.org>". Sorry for the typo.
register_chrdev() reserves exactly 256 minors so it is not possible for
input_open_file() to be called with minor that will get us out of
bounds.
Thanks.
--
Dmitry
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] input: fix input_open_file() accessing out-of-bound buffers
2012-09-13 16:57 ` Dmitry Torokhov
@ 2012-09-13 17:00 ` David Herrmann
0 siblings, 0 replies; 4+ messages in thread
From: David Herrmann @ 2012-09-13 17:00 UTC (permalink / raw)
To: Dmitry Torokhov; +Cc: linux-input
Hi Dmitry
On Thu, Sep 13, 2012 at 6:57 PM, Dmitry Torokhov
<dmitry.torokhov@gmail.com> wrote:
> Hi David,
>
> On Thu, Sep 13, 2012 at 06:18:17PM +0200, David Herrmann wrote:
>> Hi Dmitry
>>
>> On Thu, Sep 13, 2012 at 6:17 PM, David Herrmann
>> <dh.herrmann@googlemail.com> wrote:
>> > The "input_table" array is very small and we cannot be sure that the file
>> > the user opens has a minor-ID below 256 (8 << 5). Hence, simply check that
>> > the minor isn't out-of-bounds. If it is, return -ENODEV.
>> >
>> > Signed-off-by: David Herrmann <dh.herrmann@googlemail.com>
>> > Cc: <stable@kernel.org>
>>
>> This should be "Cc: <stable@vger.kernel.org>". Sorry for the typo.
>
> register_chrdev() reserves exactly 256 minors so it is not possible for
> input_open_file() to be called with minor that will get us out of
> bounds.
Ah, magic numbers. I love them!
But thanks, good to know, as I am currently working on integrating
dynamic-minors.
Sorry for the noise. Regards
David
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2012-09-13 17:00 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2012-09-13 16:17 [PATCH] input: fix input_open_file() accessing out-of-bound buffers David Herrmann
2012-09-13 16:18 ` David Herrmann
2012-09-13 16:57 ` Dmitry Torokhov
2012-09-13 17:00 ` David Herrmann
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).