summaryrefslogtreecommitdiffstats
path: root/drivers/input/input.c
diff options
context:
space:
mode:
authorDmitry Torokhov <dtor@chromium.org>2014-07-20 01:30:31 +0200
committerDmitry Torokhov <dmitry.torokhov@gmail.com>2014-07-20 22:17:42 +0200
commit50c5d36dab930b1f1b1e3348b8608aa8b9ee7610 (patch)
treeadbc15400bc011ffc9ed4a716096bc3c02f73cf6 /drivers/input/input.c
parentInput: sirfsoc-onkey - fix GPL v2 license string typo (diff)
downloadlinux-50c5d36dab930b1f1b1e3348b8608aa8b9ee7610.tar.xz
linux-50c5d36dab930b1f1b1e3348b8608aa8b9ee7610.zip
Input: fix defuzzing logic
We attempt to remove noise from coordinates reported by devices in input_handle_abs_event(), unfortunately, unless we were dropping the event altogether, we were ignoring the adjusted value and were passing on the original value instead. Cc: stable@vger.kernel.org Reviewed-by: Andrew de los Reyes <adlr@chromium.org> Reviewed-by: Benson Leung <bleung@chromium.org> Reviewed-by: David Herrmann <dh.herrmann@gmail.com> Reviewed-by: Henrik Rydberg <rydberg@euromail.se> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Diffstat (limited to '')
-rw-r--r--drivers/input/input.c6
1 files changed, 4 insertions, 2 deletions
diff --git a/drivers/input/input.c b/drivers/input/input.c
index 1c4c0db05550..29ca0bb4f561 100644
--- a/drivers/input/input.c
+++ b/drivers/input/input.c
@@ -257,9 +257,10 @@ static int input_handle_abs_event(struct input_dev *dev,
}
static int input_get_disposition(struct input_dev *dev,
- unsigned int type, unsigned int code, int value)
+ unsigned int type, unsigned int code, int *pval)
{
int disposition = INPUT_IGNORE_EVENT;
+ int value = *pval;
switch (type) {
@@ -357,6 +358,7 @@ static int input_get_disposition(struct input_dev *dev,
break;
}
+ *pval = value;
return disposition;
}
@@ -365,7 +367,7 @@ static void input_handle_event(struct input_dev *dev,
{
int disposition;
- disposition = input_get_disposition(dev, type, code, value);
+ disposition = input_get_disposition(dev, type, code, &value);
if ((disposition & INPUT_PASS_TO_DEVICE) && dev->event)
dev->event(dev, type, code, value);