You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Dan Carpenter 05be8b81aa Input: force feedback - potential integer wrap in input_ff_create() ... The problem here is that max_effects can wrap on 32 bits systems. We'd allocate a smaller amount of data than sizeof(struct ff_device). The call to kcalloc() on the next line would fail but it would write the NULL return outside of the memory we just allocated causing data corruption. The call path is that uinput_setup_device() get ->ff_effects_max from the user and sets the value in the ->private_data struct. From there it is: -> uinput_ioctl_handler() -> uinput_create_device() -> input_ff_create(dev, udev->ff_effects_max); I've also changed ff_effects_max so it's an unsigned int instead of a signed int as a cleanup. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Dmitry Torokhov <dtor@mail.ru>		14 years ago
..
acpi	Merge branch 'apei-release' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux-acpi-2.6	14 years ago
asm-generic	All Arch: remove linkage for sys_nfsservctl system call	14 years ago
crypto	…
drm	drm: Separate EDID Header Check from EDID Block Check	14 years ago
keys	…
linux	Input: force feedback - potential integer wrap in input_ff_create()	14 years ago
math-emu	…
media	…
mtd	…
net	ipv4: route non-local sources for raw socket	14 years ago
pcmcia	…
rdma	…
rxrpc	…
scsi	Merge branch 'for-linus' of git://git.open-osd.org/linux-open-osd	14 years ago
sound	ASoC: omap: Update e-mail address of Jarkko Nikula	14 years ago
target	target: Make standard INQUIRY return 'not connected' for tpg_virt_lun0	14 years ago
trace	Merge branch 'for-linus' of git://git.kernel.dk/linux-block	14 years ago
video	…
xen	…
Kbuild	…