Dmitry Torokhov 3ae8eeb150 Input: uinput - reject requests with unreasonable number of slots ...

[ Upstream commit 206f533a0a7c683982af473079c4111f4a0f9f5e ]

From: Dmitry Torokhov <dmitry.torokhov@gmail.com>

When exercising uinput interface syzkaller may try setting up device
with a really large number of slots, which causes memory allocation
failure in input_mt_init_slots(). While this allocation failure is
handled properly and request is rejected, it results in syzkaller
reports. Additionally, such request may put undue burden on the
system which will try to free a lot of memory for a bogus request.

Fix it by limiting allowed number of slots to 100. This can easily
be extended if we see devices that can track more than 100 contacts.

Reported-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Reported-by: syzbot <syzbot+0122fa359a69694395d5@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=0122fa359a69694395d5
Link: https://lore.kernel.org/r/Zqgi7NYEbpRsJfa2@google.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit 9c6d189f0c1c59ba9a32326ec82a0b367a3cd47b)
Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>

2025-04-25 03:30:10 +00:00

..

vl53l0x

driver: input: vl53l0x: fix data conflict when use multi sensor

2018-09-21 09:24:55 +08:00

88pm80x_onkey.c

…

88pm860x_onkey.c

…

ab8500-ponkey.c

…

ad714x-i2c.c

…

ad714x-spi.c

…

ad714x.c

…

ad714x.h

…

adxl34x-i2c.c

…

adxl34x-spi.c

…

adxl34x.c

Input: adxl34x - clean up a data type in adxl34x_probe()

2020-11-24 13:03:01 +01:00

adxl34x.h

…

apanel.c

Input: apanel - spelling mistake - "skiping" -> "skipping"

2016-06-23 10:44:01 -07:00

arizona-haptics.c

…

ati_remote2.c

…

atlas_btns.c

…

atmel_captouch.c

Input: add Atmel Captouch Button driver

2016-05-18 15:08:19 -07:00

axp20x-pek.c

…

bfin_rotary.c

…

bma150.c

Input: bma150 - register input device after setting private data

2019-02-20 10:18:32 +01:00

cm109.c

Input: cm109 - do not stomp on control URB

2020-12-29 13:44:47 +01:00

cma3000_d0x_i2c.c

…

cma3000_d0x.c

…

cma3000_d0x.h

…

cobalt_btns.c

…

da9052_onkey.c

…

da9055_onkey.c

…

da9063_onkey.c

Input: da9063 - fix capability and drop KEY_SLEEP

2019-10-29 09:15:20 +01:00

dm355evm_keys.c

…

drv260x.c

Input: drv260x - fix initializing overdrive voltage

2018-04-29 11:31:56 +02:00

drv2665.c

…

drv2667.c

…

e3x0-button.c

…

gp2ap002a00f.c

…

gpio_axis.c

ANDROID: Input: Generic GPIO Input device.

2017-01-19 13:31:41 -08:00

gpio_decoder.c

Input: add generic input driver to read encoded GPIO lines

2016-08-29 20:24:23 -07:00

gpio_event.c

ANDROID: input: misc: gpio_event: remove early suspend

2017-01-19 13:31:42 -08:00

gpio_input.c

ANDROID: gpio_input: convert from wakelocks to wakeup sources

2017-01-19 13:31:47 -08:00

gpio_matrix.c

ANDROID: gpio_matrix: Remove wakelock.h dependencies

2017-01-31 10:45:53 -08:00

gpio_output.c

ANDROID: Input: Generic GPIO Input device.

2017-01-19 13:31:41 -08:00

gpio_tilt_polled.c

…

gpio-beeper.c

…

hbtp_input.c

input: misc: hbtp_input compile drm callbacks properly

2018-03-16 15:02:20 +05:30

hisi_powerkey.c

Input: add powerkey driver for HISI 65xx SoC

2016-06-23 13:45:54 -07:00

hp_sdc_rtc.c

…

ideapad_slidebar.c

…

ims-pcu.c

Input: ims-psu - check if CDC union descriptor is sane

2017-11-18 11:22:24 +01:00

ixp4xx-beeper.c

…

Kconfig

Merge android-4.9.166 (0166b9e) into msm-4.9

2019-05-23 14:26:39 +08:00

keyspan_remote.c

Input: keyspan-remote - fix control-message timeouts

2020-01-29 10:24:38 +01:00

kxtj9.c

…

m68kspkr.c

…

Makefile

Merge android-4.9.166 (0166b9e) into msm-4.9

2019-05-23 14:26:39 +08:00

max8925_onkey.c

…

max8997_haptic.c

Merge tag 'pwm/for-4.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/thierry.reding/linux-pwm

2016-05-25 10:40:15 -07:00

max77693-haptic.c

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input

2016-10-07 09:12:19 -07:00

mc13783-pwrbutton.c

…

mma8450.c

…

mpu3050.c

…

palmas-pwrbutton.c

…

pcap_keys.c

…

pcf8574_keypad.c

…

pcf50633-input.c

…

pcspkr.c

…

pm8xxx-vibrator.c

…

pm8941-pwrkey.c

…

pmic8xxx-pwrkey.c

…

powermate.c

…

pwm-beeper.c

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input

2016-05-27 19:14:35 -07:00

qpnp-power-on.c

msm: qpnp-power-on: configure KPDPWR_N S2 for HARD_RESET at TWM entry

2018-07-23 06:56:01 -07:00

qti-haptics.c

input: qti-haptics: Add null check to time_us variable

2025-02-24 14:03:16 +00:00

rb532_button.c

…

regulator-haptic.c

Input: regulator-haptic - fix spelling mistake: "dveice" -> "device"

2016-06-23 10:43:57 -07:00

retu-pwrbutton.c

…

rotary_encoder.c

Input: rotary_encoder - support binary encoding of states

2016-07-27 18:26:10 -07:00

sgi_btns.c

…

sirfsoc-onkey.c

…

soc_button_array.c

…

sparcspkr.c

Input: sparcspkr - fix refcount leak in bbc_beep_probe

2022-06-14 16:52:33 +02:00

tps65218-pwrbutton.c

Input: tps65218-pwrbutton - add support for tps65217 variant

2016-09-10 10:47:49 -07:00

twl4030-pwrbutton.c

Input: twl4030-pwrbutton - use correct device for irq request

2018-03-24 11:00:20 +01:00

twl4030-vibra.c

Input: twl4030-vibra - fix sibling-node lookup

2018-01-23 19:57:07 +01:00

twl6040-vibra.c

Input: twl6040-vibra - fix child-node lookup

2018-01-23 19:57:07 +01:00

uinput.c

Input: uinput - reject requests with unreasonable number of slots

2025-04-25 03:30:10 +00:00

wistron_btns.c

…

wm831x-on.c

…

xen-kbdfront.c

Input: xen-kbdfront - prefer xenbus_write() over xenbus_printf() where possible

2016-07-13 17:27:24 -07:00

yealink.c

Input: yealink - validate number of endpoints before using them

2017-03-30 09:41:23 +02:00

yealink.h

…