1. 13 Oct, 2011 1 commit
    • Dan Carpenter's avatar
      Input: force feedback - potential integer wrap in input_ff_create() · 05be8b81
      Dan Carpenter authored
      The problem here is that max_effects can wrap on 32 bits systems.
      We'd allocate a smaller amount of data than sizeof(struct ff_device).
      The call to kcalloc() on the next line would fail but it would write
      the NULL return outside of the memory we just allocated causing data
      corruption.
      
      The call path is that uinput_setup_device() get ->ff_effects_max from
      the user and sets the value in the ->private_data struct.  From there
      it is:
      -> uinput_ioctl_handler()
         -> uinput_create_device()
            -> input_ff_create(dev, udev->ff_effects_max);
      
      I've also changed ff_effects_max so it's an unsigned int instead of
      a signed int as a cleanup.
      Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
      Signed-off-by: default avatarDmitry Torokhov <dtor@mail.ru>
      05be8b81
  2. 12 Oct, 2011 1 commit
  3. 11 Oct, 2011 10 commits
  4. 10 Oct, 2011 3 commits
  5. 07 Oct, 2011 5 commits
  6. 05 Oct, 2011 4 commits
  7. 28 Sep, 2011 1 commit
  8. 21 Sep, 2011 10 commits
  9. 09 Sep, 2011 5 commits