On Jan 31 2017 or thereabouts, Dmitry Torokhov wrote: > If user tries to initialize uinput device mixing old and new style > initialization (i.e. using old UI_SET_ABSBIT instead of UI_ABS_SETUP, > we forget to allocate input->absinfo and will crash when trying to send > absolute events: > > ioctl(ui, UI_DEV_SETUP, &us); > ioctl(ui, UI_SET_EVBIT, EV_ABS); > ioctl(ui, UI_SET_ABSBIT, ABS_X); > ioctl(ui, UI_SET_ABSBIT, ABS_Y); > ioctl(ui, UI_DEV_CREATE, 0);
Shouldn't we prevent completely the mix of the 2 versions? If the user used UI_DEV_SETUP, we should probably prevent the use of UI_SET_ABSBIT afterwards, or at least warn it somehow. But the patch in itself doesn't hurt, so: Reviewed-by: Benjamin Tissoires <[email protected]> Cheers, Benjamin > > Reported-by: Rodrigo Rivas Costa <[email protected]> > Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=191811 > Fixes: fbae10db0940 ("Input: uinput - rework ABS validation") > Cc: [email protected] > Signed-off-by: Dmitry Torokhov <[email protected]> > --- > drivers/input/misc/uinput.c | 20 ++++++++++++++------ > 1 file changed, 14 insertions(+), 6 deletions(-) > > diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c > index 92595b98e7ed..022be0e22eba 100644 > --- a/drivers/input/misc/uinput.c > +++ b/drivers/input/misc/uinput.c > @@ -263,13 +263,21 @@ static int uinput_create_device(struct uinput_device > *udev) > return -EINVAL; > } > > - if (test_bit(ABS_MT_SLOT, dev->absbit)) { > - nslot = input_abs_get_max(dev, ABS_MT_SLOT) + 1; > - error = input_mt_init_slots(dev, nslot, 0); > - if (error) > + if (test_bit(EV_ABS, dev->evbit)) { > + input_alloc_absinfo(dev); > + if (!dev->absinfo) { > + error = -EINVAL; > goto fail1; > - } else if (test_bit(ABS_MT_POSITION_X, dev->absbit)) { > - input_set_events_per_packet(dev, 60); > + } > + > + if (test_bit(ABS_MT_SLOT, dev->absbit)) { > + nslot = input_abs_get_max(dev, ABS_MT_SLOT) + 1; > + error = input_mt_init_slots(dev, nslot, 0); > + if (error) > + goto fail1; > + } else if (test_bit(ABS_MT_POSITION_X, dev->absbit)) { > + input_set_events_per_packet(dev, 60); > + } > } > > if (test_bit(EV_FF, dev->evbit) && !udev->ff_effects_max) { > -- > 2.11.0.483.g087da7b7c-goog > > -- > Dmitry
