diff options
| author | Mauro Carvalho Chehab <mchehab+huawei@kernel.org> | 2024-08-05 08:25:09 +0200 |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab+huawei@kernel.org> | 2024-08-05 08:25:09 +0200 |
| commit | 2c25dcc2361949bc7da730d22de36c019c6bf1e3 (patch) | |
| tree | 3422f89adb17748bde8419918cb7959d79c773f3 /drivers/input/input-mt.c | |
| parent | ba5c778cab1dd3e4918f940989e771e2818afee8 (diff) | |
| parent | de9c2c66ad8e787abec7c9d7eff4f8c3cdd28aed (diff) | |
Merge tag 'v6.11-rc2' into media_stage
Linux 6.11-rc2
* tag 'v6.11-rc2': (283 commits)
Linux 6.11-rc2
profiling: remove profile=sleep support
arm: dts: arm: versatile-ab: Fix duplicate clock node name
runtime constants: deal with old decrepit linkers
clocksource: Fix brown-bag boolean thinko in cs_watchdog_read()
cifs: update internal version number
smb: client: fix FSCTL_GET_REPARSE_POINT against NetApp
smb3: add dynamic tracepoints for shutdown ioctl
cifs: Remove cifs_aio_ctx
smb: client: handle lack of FSCTL_GET_REPARSE_POINT support
arm64: jump_label: Ensure patched jump_labels are visible to all CPUs
syscalls: fix syscall macros for newfstat/newfstatat
uretprobe: change syscall number, again
thermal: core: Update thermal zone registration documentation
Revert "nouveau: rip out busy fence waits"
protect the fetch of ->fd[fd] in do_dup2() from mispredictions
x86/uaccess: Zero the 8-byte get_range case on failure on 32-bit
riscv: Fix linear mapping checks for non-contiguous memory regions
KVM: x86/mmu: fix determination of max NPT mapping level for private pages
PCI: pciehp: Retain Power Indicator bits for userspace indicators
...
Diffstat (limited to 'drivers/input/input-mt.c')
| -rw-r--r-- | drivers/input/input-mt.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/input/input-mt.c b/drivers/input/input-mt.c index 14b53dac1253..6b04a674f832 100644 --- a/drivers/input/input-mt.c +++ b/drivers/input/input-mt.c @@ -46,6 +46,9 @@ int input_mt_init_slots(struct input_dev *dev, unsigned int num_slots, return 0; if (mt) return mt->num_slots != num_slots ? -EINVAL : 0; + /* Arbitrary limit for avoiding too large memory allocation. */ + if (num_slots > 1024) + return -EINVAL; mt = kzalloc(struct_size(mt, slots, num_slots), GFP_KERNEL); if (!mt) |