diff options
author | Linus Torvalds <torvalds@linux-foundation.org> | 2011-03-19 22:27:06 -0700 |
---|---|---|
committer | Linus Torvalds <torvalds@linux-foundation.org> | 2011-03-19 22:27:06 -0700 |
commit | a952baa034ae7c2e4a66932005cbc7ebbccfe28d (patch) | |
tree | ff5abe0c77f5b129946300677d9b57b00d926a1e /drivers/input/misc/uinput.c | |
parent | 5bab188a316718a26346cdb25c4cc6b319f8f907 (diff) | |
parent | 97eb3f24352ec6632c2127b35d8087d2a809a9b9 (diff) | |
download | op-kernel-dev-a952baa034ae7c2e4a66932005cbc7ebbccfe28d.zip op-kernel-dev-a952baa034ae7c2e4a66932005cbc7ebbccfe28d.tar.gz |
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: (64 commits)
Input: tsc2005 - remove 'disable' sysfs attribute
Input: tsc2005 - add open/close
Input: tsc2005 - handle read errors from SPI layer
Input: tsc2005 - do not rearm timer in hardirq handler
Input: tsc2005 - don't use work for 'pen up' handling
Input: tsc2005 - do not use 0 in place of NULL
Input: tsc2005 - use true/false for boolean variables
Input: tsc2005 - hide selftest attribute if we can't reset
Input: tsc2005 - rework driver initialization code
Input: tsc2005 - set up bus type in input device
Input: tsc2005 - set up parent device
Input: tsc2005 - clear driver data after unbinding
Input: tsc2005 - add module description
Input: tsc2005 - remove driver banner message
Input: tsc2005 - remove incorrect module alias
Input: tsc2005 - convert to using dev_pm_ops
Input: tsc2005 - use spi_get/set_drvdata()
Input: introduce tsc2005 driver
Input: xen-kbdfront - move to drivers/input/misc
Input: xen-kbdfront - add grant reference for shared page
...
Diffstat (limited to 'drivers/input/misc/uinput.c')
-rw-r--r-- | drivers/input/misc/uinput.c | 48 |
1 files changed, 16 insertions, 32 deletions
diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c index 82542a1..364bdf4 100644 --- a/drivers/input/misc/uinput.c +++ b/drivers/input/misc/uinput.c @@ -347,8 +347,7 @@ static int uinput_setup_device(struct uinput_device *udev, const char __user *bu { struct uinput_user_dev *user_dev; struct input_dev *dev; - char *name; - int i, size; + int i; int retval; if (count != sizeof(struct uinput_user_dev)) @@ -362,30 +361,25 @@ static int uinput_setup_device(struct uinput_device *udev, const char __user *bu dev = udev->dev; - user_dev = kmalloc(sizeof(struct uinput_user_dev), GFP_KERNEL); - if (!user_dev) - return -ENOMEM; - - if (copy_from_user(user_dev, buffer, sizeof(struct uinput_user_dev))) { - retval = -EFAULT; - goto exit; - } + user_dev = memdup_user(buffer, sizeof(struct uinput_user_dev)); + if (IS_ERR(user_dev)) + return PTR_ERR(user_dev); udev->ff_effects_max = user_dev->ff_effects_max; - size = strnlen(user_dev->name, UINPUT_MAX_NAME_SIZE) + 1; - if (!size) { + /* Ensure name is filled in */ + if (!user_dev->name[0]) { retval = -EINVAL; goto exit; } kfree(dev->name); - dev->name = name = kmalloc(size, GFP_KERNEL); - if (!name) { + dev->name = kstrndup(user_dev->name, UINPUT_MAX_NAME_SIZE, + GFP_KERNEL); + if (!dev->name) { retval = -ENOMEM; goto exit; } - strlcpy(name, user_dev->name, size); dev->id.bustype = user_dev->id.bustype; dev->id.vendor = user_dev->id.vendor; @@ -622,7 +616,6 @@ static long uinput_ioctl_handler(struct file *file, unsigned int cmd, struct uinput_ff_upload ff_up; struct uinput_ff_erase ff_erase; struct uinput_request *req; - int length; char *phys; retval = mutex_lock_interruptible(&udev->mutex); @@ -689,24 +682,15 @@ static long uinput_ioctl_handler(struct file *file, unsigned int cmd, retval = -EINVAL; goto out; } - length = strnlen_user(p, 1024); - if (length <= 0) { - retval = -EFAULT; - break; + + phys = strndup_user(p, 1024); + if (IS_ERR(phys)) { + retval = PTR_ERR(phys); + goto out; } + kfree(udev->dev->phys); - udev->dev->phys = phys = kmalloc(length, GFP_KERNEL); - if (!phys) { - retval = -ENOMEM; - break; - } - if (copy_from_user(phys, p, length)) { - udev->dev->phys = NULL; - kfree(phys); - retval = -EFAULT; - break; - } - phys[length - 1] = '\0'; + udev->dev->phys = phys; break; case UI_BEGIN_FF_UPLOAD: |