|
@@ -626,8 +626,11 @@ static long evdev_do_ioctl(struct file *file, unsigned int cmd,
|
|
|
abs.maximum = dev->absmax[t];
|
|
|
abs.fuzz = dev->absfuzz[t];
|
|
|
abs.flat = dev->absflat[t];
|
|
|
+ abs.resolution = dev->absres[t];
|
|
|
|
|
|
- if (copy_to_user(p, &abs, sizeof(struct input_absinfo)))
|
|
|
+ if (copy_to_user(p, &abs, min_t(size_t,
|
|
|
+ _IOC_SIZE(cmd),
|
|
|
+ sizeof(struct input_absinfo))))
|
|
|
return -EFAULT;
|
|
|
|
|
|
return 0;
|
|
@@ -654,8 +657,9 @@ static long evdev_do_ioctl(struct file *file, unsigned int cmd,
|
|
|
|
|
|
t = _IOC_NR(cmd) & ABS_MAX;
|
|
|
|
|
|
- if (copy_from_user(&abs, p,
|
|
|
- sizeof(struct input_absinfo)))
|
|
|
+ if (copy_from_user(&abs, p, min_t(size_t,
|
|
|
+ _IOC_SIZE(cmd),
|
|
|
+ sizeof(struct input_absinfo))))
|
|
|
return -EFAULT;
|
|
|
|
|
|
/*
|
|
@@ -670,6 +674,8 @@ static long evdev_do_ioctl(struct file *file, unsigned int cmd,
|
|
|
dev->absmax[t] = abs.maximum;
|
|
|
dev->absfuzz[t] = abs.fuzz;
|
|
|
dev->absflat[t] = abs.flat;
|
|
|
+ dev->absres[t] = _IOC_SIZE(cmd) < sizeof(struct input_absinfo) ?
|
|
|
+ 0 : abs.resolution;
|
|
|
|
|
|
spin_unlock_irq(&dev->event_lock);
|
|
|
|