[3.16.y-ckt stable] Patch "Input: evdev - fix EVIOCG{type} ioctl" has been added to staging queue

[Luis Henriques]

This is a note to let you know that I have just added a patch titled

    Input: evdev - fix EVIOCG{type} ioctl

to the linux-3.16.y-queue branch of the 3.16.y-ckt extended stable tree 
which can be found at:

 http://kernel.ubuntu.com/git?p=ubuntu/linux.git;a=shortlog;h=refs/heads/linux-3.16.y-queue

This patch is scheduled to be released in version 3.16.7-ckt6.

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.16.y-ckt tree, see
https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable

Thanks.
-Luis

------

>From 00b7e31d68cc09b57a47cddf00871d53dff5e757 Mon Sep 17 00:00:00 2001
From: Dmitry Torokhov <dmitry.torokhov at gmail.com>
Date: Mon, 6 Oct 2014 10:55:49 -0700
Subject: Input: evdev - fix EVIOCG{type} ioctl

commit 7c4f56070fde2367766fa1fb04852599b5e1ad35 upstream.

The 'max' size passed into the function is measured in number of bits
(KEY_MAX, LED_MAX, etc) so we need to convert it accordingly before trying
to copy the data out, otherwise we will try copying too much and end up
with up with a page fault.

Reported-by: Pavel Machek <pavel at ucw.cz>
Reviewed-by: Pavel Machek <pavel at ucw.cz>
Reviewed-by: David Herrmann <dh.herrmann at gmail.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov at gmail.com>
Signed-off-by: Luis Henriques <luis.henriques at canonical.com>
---
 drivers/input/evdev.c | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c
index b51970d1e9ee..f8e1f98bc222 100644
--- a/drivers/input/evdev.c
+++ b/drivers/input/evdev.c
@@ -739,20 +739,23 @@ static int evdev_handle_set_keycode_v2(struct input_dev *dev, void __user *p)
  */
 static int evdev_handle_get_val(struct evdev_client *client,
 				struct input_dev *dev, unsigned int type,
-				unsigned long *bits, unsigned int max,
-				unsigned int size, void __user *p, int compat)
+				unsigned long *bits, unsigned int maxbit,
+				unsigned int maxlen, void __user *p,
+				int compat)
 {
 	int ret;
 	unsigned long *mem;
+	size_t len;

-	mem = kmalloc(sizeof(unsigned long) * max, GFP_KERNEL);
+	len = BITS_TO_LONGS(maxbit) * sizeof(unsigned long);
+	mem = kmalloc(len, GFP_KERNEL);
 	if (!mem)
 		return -ENOMEM;

 	spin_lock_irq(&dev->event_lock);
 	spin_lock(&client->buffer_lock);

-	memcpy(mem, bits, sizeof(unsigned long) * max);
+	memcpy(mem, bits, len);

 	spin_unlock(&dev->event_lock);

@@ -760,7 +763,7 @@ static int evdev_handle_get_val(struct evdev_client *client,

 	spin_unlock_irq(&client->buffer_lock);

-	ret = bits_to_user(mem, max, size, p, compat);
+	ret = bits_to_user(mem, maxbit, maxlen, p, compat);
 	if (ret < 0)
 		evdev_queue_syn_dropped(client);

--
2.1.4