On Mon, Jan 14, 2019 at 02:04:48PM -0800, Dmitry Torokhov wrote: > An integer overflow may arise in uinput_validate_absinfo() if "max - min" > can't be represented by an "int". We should check for overflow before > trying to use the result. > > Reported-by: Kyungtae Kim <[email protected]> > Cc: [email protected] > Signed-off-by: Dmitry Torokhov <[email protected]> > --- > drivers/input/misc/uinput.c | 5 +++-- > 1 file changed, 3 insertions(+), 2 deletions(-) > > diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c > index 8ec483e8688b..26ec603fe220 100644 > --- a/drivers/input/misc/uinput.c > +++ b/drivers/input/misc/uinput.c > @@ -39,6 +39,7 @@ > #include <linux/init.h> > #include <linux/fs.h> > #include <linux/miscdevice.h> > +#include <linux/overflow.h> > #include <linux/input/mt.h> > #include "../input-compat.h" > > @@ -405,7 +406,7 @@ static int uinput_open(struct inode *inode, struct file > *file) > static int uinput_validate_absinfo(struct input_dev *dev, unsigned int code, > const struct input_absinfo *abs) > { > - int min, max; > + int min, max, range; > > min = abs->minimum; > max = abs->maximum; > @@ -417,7 +418,7 @@ static int uinput_validate_absinfo(struct input_dev *dev, > unsigned int code, > return -EINVAL; > } > > - if (abs->flat > max - min) { > + if (check_sub_overflow(max, min, &range) && abs->flat > range) {
This should be !check_sub_overflow(...) of course. > printk(KERN_DEBUG > "%s: abs_flat #%02x out of range: %d (min:%d/max:%d)\n", > UINPUT_NAME, code, abs->flat, min, max); > -- > 2.20.1.97.g81188d93c3-goog > > > -- > Dmitry -- Dmitry
