Re: uinput oops and panic

[Aristeu Sergio Rozanski Filho]

hi,
	this patch solves the problem, thanks for reporting
	(i already sent it to Vojtech Pavlik that will submit it to linus)

-- 
aris
# This is a BitKeeper generated patch for the following project:
# Project Name: Linux kernel tree
# This patch format is intended for GNU patch command version 2.5 or higher.
# This patch includes the following deltas:
#	           ChangeSet	1.1149  -> 1.1150 
#	drivers/input/misc/uinput.c	1.11    -> 1.12   
#
# The following is the BitKeeper ChangeSet Log
# --------------------------------------------
# 03/08/13	aris@xxxxxxxxxxxxxxxxx	1.1150
# verify maximum number of bits before using set_bit
# --------------------------------------------
#
diff -Nru a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c
--- a/drivers/input/misc/uinput.c	Wed Aug 13 17:50:03 2003
+++ b/drivers/input/misc/uinput.c	Wed Aug 13 17:50:03 2003
@@ -323,36 +323,67 @@
 			retval = uinput_destroy_device(udev);
 			break;
 
-
 		case UI_SET_EVBIT:
+			if (arg > EV_MAX) {
+				retval = -EINVAL;
+				break;
+			}
 			set_bit(arg, udev->dev->evbit);
 			break;
 			
 		case UI_SET_KEYBIT:
+			if (arg > KEY_MAX) {
+				retval = -EINVAL;
+				break;
+			}
 			set_bit(arg, udev->dev->keybit);
 			break;
 			
 		case UI_SET_RELBIT:
+			if (arg > REL_MAX) {
+				retval = -EINVAL;
+				break;
+			}
 			set_bit(arg, udev->dev->relbit);
 			break;
 			
 		case UI_SET_ABSBIT:
+			if (arg > ABS_MAX) {
+				retval = -EINVAL;
+				break;
+			}
 			set_bit(arg, udev->dev->absbit);
 			break;
 			
 		case UI_SET_MSCBIT:
+			if (arg > MSC_MAX) {
+				retval = -EINVAL;
+				break;
+			}
 			set_bit(arg, udev->dev->mscbit);
 			break;
 			
 		case UI_SET_LEDBIT:
+			if (arg > LED_MAX) {
+				retval = -EINVAL;
+				break;
+			}
 			set_bit(arg, udev->dev->ledbit);
 			break;
 			
 		case UI_SET_SNDBIT:
+			if (arg > SND_MAX) {
+				retval = -EINVAL;
+				break;
+			}
 			set_bit(arg, udev->dev->sndbit);
 			break;
 			
 		case UI_SET_FFBIT:
+			if (arg > FF_MAX) {
+				retval = -EINVAL;
+				break;
+			}
 			set_bit(arg, udev->dev->ffbit);
 			break;