michael/linux
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
Files
linux-6.10.y
linux/drivers/input/misc
History
Dmitry Torokhov d76fc0f0b1 Input: uinput - reject requests with unreasonable number of slots 
[ Upstream commit 206f533a0a ]

From: Dmitry Torokhov <dmitry.torokhov@gmail.com>

When exercising uinput interface syzkaller may try setting up device
with a really large number of slots, which causes memory allocation
failure in input_mt_init_slots(). While this allocation failure is
handled properly and request is rejected, it results in syzkaller
reports. Additionally, such request may put undue burden on the
system which will try to free a lot of memory for a bogus request.

Fix it by limiting allowed number of slots to 100. This can easily
be extended if we see devices that can track more than 100 contacts.

Reported-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Reported-by: syzbot <syzbot+0122fa359a69694395d5@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=0122fa359a69694395d5
Link: https://lore.kernel.org/r/Zqgi7NYEbpRsJfa2@google.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-09-12 11:13:04 +02:00
..
88pm80x_onkey.c
Input: 88pm80x_onkey - add SPDX and drop GPL boilerplate
2024-01-22 11:14:06 -08:00
88pm860x_onkey.c
Input: 88pm860x - switch to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr()
2023-01-09 20:25:20 -08:00
ab8500-ponkey.c
…
ad714x-i2c.c
Input: drop explicit initialization of struct i2c_device_id::driver_data to 0
2024-05-13 15:43:19 -07:00
ad714x-spi.c
Input: ad714x - unify dev_pm_ops using EXPORT_SIMPLE_DEV_PM_OPS()
2023-01-27 14:49:52 -08:00
ad714x.c
Input: ad714x - unify dev_pm_ops using EXPORT_SIMPLE_DEV_PM_OPS()
2023-01-27 14:49:52 -08:00
ad714x.h
Input: ad714x - unify dev_pm_ops using EXPORT_SIMPLE_DEV_PM_OPS()
2023-01-27 14:49:52 -08:00
adxl34x-i2c.c
Input: drop explicit initialization of struct i2c_device_id::driver_data to 0
2024-05-13 15:43:19 -07:00
adxl34x-spi.c
Input: adxl34x - unify dev_pm_ops using EXPORT_SIMPLE_DEV_PM_OPS()
2023-01-27 14:49:53 -08:00
adxl34x.c
Input: adxl34x - do not hardcode interrupt trigger type
2023-05-10 17:28:57 -07:00
adxl34x.h
Input: adxl34x - unify dev_pm_ops using EXPORT_SIMPLE_DEV_PM_OPS()
2023-01-27 14:49:53 -08:00
apanel.c
Input: drop explicit initialization of struct i2c_device_id::driver_data to 0
2024-05-13 15:43:19 -07:00
ariel-pwrbutton.c
…
arizona-haptics.c
…
atc260x-onkey.c
…
ati_remote2.c
…
atlas_btns.c
Input: atlas - drop owner assignment
2024-04-08 16:16:55 +02:00
atmel_captouch.c
Input: drop explicit initialization of struct i2c_device_id::driver_data to 0
2024-05-13 15:43:19 -07:00
axp20x-pek.c
Input: axp20x-pek - avoid needless newline removal
2023-09-30 09:35:31 -07:00
bma150.c
Input: drop explicit initialization of struct i2c_device_id::driver_data to 0
2024-05-13 15:43:19 -07:00
cm109.c
…
cma3000_d0x_i2c.c
Input: drop explicit initialization of struct i2c_device_id::driver_data to 0
2024-05-13 15:43:19 -07:00
cma3000_d0x.c
Input: cma3000_d0x - remove unneeded code
2023-04-09 19:18:39 -07:00
cma3000_d0x.h
…
cobalt_btns.c
…
cpcap-pwrbutton.c
Input: cpcap-pwrbutton - replace GPLv2 boilerplate with SPDX
2023-07-05 14:50:00 -07:00
da7280.c
Merge tag 'input-for-v6.10-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input
2024-05-24 09:01:21 -07:00
da9052_onkey.c
Input: da9052_onkey - convert to platform remove callback returning void
2023-09-23 19:16:42 -07:00
da9055_onkey.c
Input: da9055_onkey - convert to platform remove callback returning void
2023-09-23 19:16:42 -07:00
da9063_onkey.c
Input: da9063_onkey - avoid explicitly setting input's parent
2024-01-04 12:02:20 -08:00
drv260x.c
Input: drop explicit initialization of struct i2c_device_id::driver_data to 0
2024-05-13 15:43:19 -07:00
drv2665.c
Input: drop explicit initialization of struct i2c_device_id::driver_data to 0
2024-05-13 15:43:19 -07:00
drv2667.c
Input: drop explicit initialization of struct i2c_device_id::driver_data to 0
2024-05-13 15:43:19 -07:00
e3x0-button.c
Input: e3x0-button - switch to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr()
2023-01-09 20:25:21 -08:00
gpio_decoder.c
…
gpio-beeper.c
…
gpio-vibra.c
Input: Explicitly include correct DT includes
2023-07-17 10:03:07 -07:00
hisi_powerkey.c
…
hp_sdc_rtc.c
Input: hp_sdc_rtc - mark an unused function as __maybe_unused
2023-02-21 13:57:40 -08:00
ibm-panel.c
Input: Switch i2c drivers back to use .probe()
2023-05-17 09:59:11 -07:00
ideapad_slidebar.c
Input: ideapad_slidebar - convert to platform remove callback returning void
2023-09-23 19:16:42 -07:00
ims-pcu.c
Input: ims-pcu - fix printf string overflow
2024-03-28 13:29:44 -07:00
iqs269a.c
Input: iqs269a - add support for OTP variants
2024-01-01 13:24:03 -08:00
iqs626a.c
Input: Explicitly include correct DT includes
2023-07-17 10:03:07 -07:00
iqs7222.c
Input: iqs7222 - add support for IQS7222D v1.1 and v1.2
2024-03-07 10:10:50 -08:00
Kconfig
Merge tag 'v6.5' into next
2023-09-05 14:08:14 -07:00
keyspan_remote.c
…
kxtj9.c
Input: drop explicit initialization of struct i2c_device_id::driver_data to 0
2024-05-13 15:43:19 -07:00
m68kspkr.c
Input: m68kspkr - convert to platform remove callback returning void
2023-09-23 19:16:43 -07:00
Makefile
Input: bbnsm_pwrkey - add bbnsm power key support
2023-02-21 13:56:35 -08:00
max8925_onkey.c
Input: max8925_onkey - switch to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr()
2023-01-09 20:25:21 -08:00
max8997_haptic.c
Input: max8997_haptic - convert to platform remove callback returning void
2023-09-23 19:16:43 -07:00
max77650-onkey.c
…
max77693-haptic.c
Input: max77693-haptic - add device-tree compatible strings
2023-12-12 21:42:36 -08:00
mc13783-pwrbutton.c
Input: mc13783-pwrbutton - convert to platform remove callback returning void
2023-09-23 19:16:43 -07:00
mma8450.c
Input: drop explicit initialization of struct i2c_device_id::driver_data to 0
2024-05-13 15:43:19 -07:00
nxp-bbnsm-pwrkey.c
Input: bbnsm_pwrkey - add bbnsm power key support
2023-02-21 13:56:35 -08:00
palmas-pwrbutton.c
Input: palmas-pwrbutton - convert to platform remove callback returning void
2023-09-23 19:16:43 -07:00
pcap_keys.c
Input: pcap_keys - convert to platform remove callback returning void
2023-09-23 19:16:43 -07:00
pcf8574_keypad.c
Input: drop explicit initialization of struct i2c_device_id::driver_data to 0
2024-05-13 15:43:19 -07:00
pcf50633-input.c
Input: pcf50633-input - convert to platform remove callback returning void
2023-09-23 19:16:43 -07:00
pcspkr.c
Input: pcspkr - convert to platform remove callback returning void
2023-09-23 19:16:44 -07:00
pm8xxx-vibrator.c
input: pm8xxx-vibrator: add new SPMI vibrator support
2024-04-17 15:27:12 -07:00
pm8941-pwrkey.c
Input: pm8941-pwrkey - convert to platform remove callback returning void
2023-09-23 19:16:44 -07:00
pmic8xxx-pwrkey.c
Input: Explicitly include correct DT includes
2023-07-17 10:03:07 -07:00
powermate.c
Input: powermate - fix use-after-free in powermate_config_complete
2023-10-13 20:17:02 -07:00
pwm-beeper.c
pwm: Rename pwm_apply_state() to pwm_apply_might_sleep()
2023-12-20 16:07:04 +01:00
pwm-vibra.c
pwm: Rename pwm_apply_state() to pwm_apply_might_sleep()
2023-12-20 16:07:04 +01:00
rave-sp-pwrbutton.c
…
rb532_button.c
…
regulator-haptic.c
Input: regulator-haptic - switch to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr()
2023-01-09 20:25:22 -08:00
retu-pwrbutton.c
…
rk805-pwrkey.c
…
rotary_encoder.c
Input: rotary_encoder - don't double assign input->dev.parent
2023-07-12 14:10:32 -07:00
rt5120-pwrkey.c
…
sc27xx-vibra.c
…
sgi_btns.c
…
soc_button_array.c
Input: soc_button_array - add mapping for airplane mode button
2023-12-22 23:34:06 -08:00
sparcspkr.c
Input: sparcspkr - convert to platform remove callback returning void
2023-09-23 19:16:44 -07:00
stpmic1_onkey.c
Input: stpmic1_onekey - switch to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr()
2023-01-09 20:25:23 -08:00
tps65218-pwrbutton.c
…
tps65219-pwrbutton.c
Input: tps65219-pwrbutton - use regmap_set_bits()
2023-06-06 11:11:58 -07:00
twl4030-pwrbutton.c
…
twl4030-vibra.c
Input: twl4030-vibra - switch to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr()
2023-01-09 20:25:23 -08:00
twl6040-vibra.c
Input: twl6030-vibra - switch to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr()
2023-01-09 20:25:23 -08:00
uinput.c
Input: uinput - reject requests with unreasonable number of slots
2024-09-12 11:13:04 +02:00
wistron_btns.c
Input: wistron_btns - convert to platform remove callback returning void
2023-09-23 19:16:44 -07:00
wm831x-on.c
Input: wm831x-on - convert to platform remove callback returning void
2023-09-23 19:16:44 -07:00
xen-kbdfront.c
xen: make remove callback of xen driver void returned
2022-12-15 16:06:10 +01:00
yealink.c
…
yealink.h
…