Re: 2.6.15-rc5-mm2: evdev problem

Rafael J. Wysocki
2005-12-11T16:08:56Z

The evdev driver is still broken due to the wrong order of arguments of
copy_to_user() in evdev_event_to_user().

The following patch fixes this issue.

Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
Index: linux-2.6.15-rc2-mm1/drivers/input/evdev.c
===================================================================
--- linux-2.6.15-rc2-mm1.orig/drivers/input/evdev.c 2005-11-23 22:07:30.000000000 +0100
+++ linux-2.6.15-rc2-mm1/drivers/input/evdev.c 2005-11-26 17:38:02.000000000 +0100
@@ -194,7 +194,7 @@
return 0;
}

-static int evdev_event_to_user(const char __user *buffer, struct input_event *event)
+static int evdev_event_to_user(char __user *buffer, struct input_event *event)
{
if (COMPAT_TEST) {
struct input_event_compat compat_event;
@@ -205,11 +205,11 @@
compat_event.code = event->code;
compat_event.value = event->value;

- if (copy_to_user(&compat_event, buffer, sizeof(struct input_event_compat)))
+ if (copy_to_user(buffer, &compat_event, sizeof(struct input_event_compat)))
return -EFAULT;

} else {
- if (copy_to_user(event, buffer, sizeof(struct input_event)))
+ if (copy_to_user(buffer, event, sizeof(struct input_event)))
return -EFAULT;
}