Input: evdev - fix EVIOCG{type} ioctl
authorDmitry Torokhov <dmitry.torokhov@gmail.com>
Mon, 6 Oct 2014 17:55:49 +0000 (10:55 -0700)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 30 Jan 2015 01:40:50 +0000 (17:40 -0800)
commitbb58e89d00af0644a87cd7c0f1392584238dc3e4
tree0eeaec65f4d0a3f6bd20338cb8abf18e97b66ba6
parent7a079c1aabcf1e2cf3c5f2ffb493e26d2204450e
Input: evdev - fix EVIOCG{type} ioctl

commit 7c4f56070fde2367766fa1fb04852599b5e1ad35 upstream.

The 'max' size passed into the function is measured in number of bits
(KEY_MAX, LED_MAX, etc) so we need to convert it accordingly before trying
to copy the data out, otherwise we will try copying too much and end up
with up with a page fault.

Reported-by: Pavel Machek <pavel@ucw.cz>
Reviewed-by: Pavel Machek <pavel@ucw.cz>
Reviewed-by: David Herrmann <dh.herrmann@gmail.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/input/evdev.c