Commit 72d47362 authored by Dmitry Torokhov's avatar Dmitry Torokhov

Input: uinput - fix crash when using ABS events

Commit b6d30968 (Input: uinput - switch to
using for_each_set_bit()) switched driver to use for_each_set_bit().
However during initial write of the uinput structure that contains min/max
data for all possible axes none of them are reflected in dev->absbit yet
and so we were skipping over all of them and were not allocating absinfo
memory which caused crash later when driver tried to sens EV_ABS events:

<1>[   15.064330] BUG: unable to handle kernel NULL pointer dereference at 0000000000000024
<1>[   15.064336] IP: [<ffffffff8163f142>] input_handle_event+0x232/0x4e0
<4>[   15.064343] PGD 0
<4>[   15.064345] Oops: 0000 [#1] SMP

Fixes: b6d30968
Cc: stable@vger.kernel.org
Reported-by: default avatarStephen Chandler Paul <cpaul@redhat.com>
Tested-by: default avatarStephen Chandler Paul <cpaul@redhat.com>
Signed-off-by: default avatarDmitry Torokhov <dmitry.torokhov@gmail.com>
parent ed75a14e
...@@ -414,7 +414,7 @@ static int uinput_setup_device(struct uinput_device *udev, ...@@ -414,7 +414,7 @@ static int uinput_setup_device(struct uinput_device *udev,
dev->id.product = user_dev->id.product; dev->id.product = user_dev->id.product;
dev->id.version = user_dev->id.version; dev->id.version = user_dev->id.version;
for_each_set_bit(i, dev->absbit, ABS_CNT) { for (i = 0; i < ABS_CNT; i++) {
input_abs_set_max(dev, i, user_dev->absmax[i]); input_abs_set_max(dev, i, user_dev->absmax[i]);
input_abs_set_min(dev, i, user_dev->absmin[i]); input_abs_set_min(dev, i, user_dev->absmin[i]);
input_abs_set_fuzz(dev, i, user_dev->absfuzz[i]); input_abs_set_fuzz(dev, i, user_dev->absfuzz[i]);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment