Patch "Input: add bounds checking to input_set_capability()" has been added to the 5.17-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    Input: add bounds checking to input_set_capability()

to the 5.17-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     input-add-bounds-checking-to-input_set_capability.patch
and it can be found in the queue-5.17 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 7f047dd70843331d424d97fdf30e002694af9575
Author: Jeff LaBundy <jeff@xxxxxxxxxxx>
Date:   Sun Mar 20 21:55:27 2022 -0700

    Input: add bounds checking to input_set_capability()
    
    [ Upstream commit 409353cbe9fe48f6bc196114c442b1cff05a39bc ]
    
    Update input_set_capability() to prevent kernel panic in case the
    event code exceeds the bitmap for the given event type.
    
    Suggested-by: Tomasz Moń <tomasz.mon@xxxxxxxxxxxxxxx>
    Signed-off-by: Jeff LaBundy <jeff@xxxxxxxxxxx>
    Reviewed-by: Tomasz Moń <tomasz.mon@xxxxxxxxxxxxxxx>
    Link: https://lore.kernel.org/r/20220320032537.545250-1-jeff@xxxxxxxxxxx
    Signed-off-by: Dmitry Torokhov <dmitry.torokhov@xxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/input/input.c b/drivers/input/input.c
index ccaeb2426385..ba246fabc6c1 100644
--- a/drivers/input/input.c
+++ b/drivers/input/input.c
@@ -47,6 +47,17 @@ static DEFINE_MUTEX(input_mutex);
 
 static const struct input_value input_value_sync = { EV_SYN, SYN_REPORT, 1 };
 
+static const unsigned int input_max_code[EV_CNT] = {
+	[EV_KEY] = KEY_MAX,
+	[EV_REL] = REL_MAX,
+	[EV_ABS] = ABS_MAX,
+	[EV_MSC] = MSC_MAX,
+	[EV_SW] = SW_MAX,
+	[EV_LED] = LED_MAX,
+	[EV_SND] = SND_MAX,
+	[EV_FF] = FF_MAX,
+};
+
 static inline int is_event_supported(unsigned int code,
 				     unsigned long *bm, unsigned int max)
 {
@@ -2074,6 +2085,14 @@ EXPORT_SYMBOL(input_get_timestamp);
  */
 void input_set_capability(struct input_dev *dev, unsigned int type, unsigned int code)
 {
+	if (type < EV_CNT && input_max_code[type] &&
+	    code > input_max_code[type]) {
+		pr_err("%s: invalid code %u for type %u\n", __func__, code,
+		       type);
+		dump_stack();
+		return;
+	}
+
 	switch (type) {
 	case EV_KEY:
 		__set_bit(code, dev->keybit);