mirror of
https://github.com/LineageOS/android_kernel_samsung_msm8226.git
synced 2026-09-29 00:00:25 +02:00
commit cb222aed03d798fc074be55e59d9a112338ee784 upstream. If we happen to have a garbage in input device's keycode table with values too big we'll end up doing clear_bit() with offset way outside of our bitmaps, damaging other objects within an input device or even outside of it. Let's add sanity checks to the returned old keycodes. Reported-by: syzbot+c769968809f9359b07aa@syzkaller.appspotmail.com Reported-by: syzbot+76f3a30e88d256644c78@syzkaller.appspotmail.com Link: https://lore.kernel.org/r/20191207212757.GA245964@dtor-ws Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Ben Hutchings <ben@decadent.org.uk> CVE-2019-20636 Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org> Change-Id: I8f9a462d3fb8a9bb4494adb0e8edfac099a35263