tree b6a62abd54ec62764faca6c16e076c037d1b91ab
parent ad7d2556d7a2728d855fe794fe943f55acf253fa
author Dmitry Torokhov <dmitry.torokhov@gmail.com> 1576277776 -0800
committer Commit Bot <commit-bot@chromium.org> 1586870752 +0000

UPSTREAM: Input: add safety guards to input_set_keycode()

If we happen to have a garbage in input device's keycode table with values
too big we'll end up doing clear_bit() with offset way outside of our
bitmaps, damaging other objects within an input device or even outside of
it. Let's add sanity checks to the returned old keycodes.

Reported-by: syzbot+c769968809f9359b07aa@syzkaller.appspotmail.com
Reported-by: syzbot+76f3a30e88d256644c78@syzkaller.appspotmail.com
Link: https://lore.kernel.org/r/20191207212757.GA245964@dtor-ws
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
(cherry picked from commit cb222aed03d798fc074be55e59d9a112338ee784)

BUG=chromium:1069757
TEST=Crafted keycode table

Change-Id: I6ed9ecbec5a11c8c3160532f7bbfc99afd6121bc
Signed-off-by: Guenter Roeck <groeck@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/2145623
Reviewed-by: Sean Paul <seanpaul@chromium.org>