---

yaml --- r: 269510 b: refs/heads/master c: 05be8b8 h: refs/heads/master v: v3
git-mirror · Oct 13, 2011 · 5fc93d6 · 5fc93d6
1 parent 1ad2e68
commit 5fc93d6
Show file tree

Hide file tree

Showing 4 changed files with 11 additions and 6 deletions.
diff --git a/[refs] b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 341deefe8f4584b09564193cb46d8cf386f491a5
+refs/heads/master: 05be8b81aafd4f95106a91ff3fd8581fa984fad9
diff --git a/trunk/drivers/input/ff-core.c b/trunk/drivers/input/ff-core.c
@@ -309,18 +309,23 @@ EXPORT_SYMBOL_GPL(input_ff_event);
  * Once ff device is created you need to setup its upload, erase,
  * playback and other handlers before registering input device
  */
-int input_ff_create(struct input_dev *dev, int max_effects)
+int input_ff_create(struct input_dev *dev, unsigned int max_effects)
 {
 	struct ff_device *ff;
+	size_t ff_dev_size;
 	int i;
 
 	if (!max_effects) {
 		pr_err("cannot allocate device without any effects\n");
 		return -EINVAL;
 	}
 
-	ff = kzalloc(sizeof(struct ff_device) +
-		     max_effects * sizeof(struct file *), GFP_KERNEL);
+	ff_dev_size = sizeof(struct ff_device) +
+				max_effects * sizeof(struct file *);
+	if (ff_dev_size < max_effects) /* overflow */
+		return -EINVAL;
+
+	ff = kzalloc(ff_dev_size, GFP_KERNEL);
 	if (!ff)
 		return -ENOMEM;
 

diff --git a/trunk/include/linux/input.h b/trunk/include/linux/input.h
@@ -1610,7 +1610,7 @@ struct ff_device {
 	struct file *effect_owners[];
 };
 
-int input_ff_create(struct input_dev *dev, int max_effects);
+int input_ff_create(struct input_dev *dev, unsigned int max_effects);
 void input_ff_destroy(struct input_dev *dev);
 
 int input_ff_event(struct input_dev *dev, unsigned int type, unsigned int code, int value);

diff --git a/trunk/include/linux/uinput.h b/trunk/include/linux/uinput.h
@@ -68,7 +68,7 @@ struct uinput_device {
 	unsigned char		head;
 	unsigned char		tail;
 	struct input_event	buff[UINPUT_BUFFER_SIZE];
-	int			ff_effects_max;
+	unsigned int		ff_effects_max;
 
 	struct uinput_request	*requests[UINPUT_NUM_REQUESTS];
 	wait_queue_head_t	requests_waitq;