2 files changed, 13 insertions, 0 deletions

diff --git a/drivers/input/ff-core.c b/drivers/input/ff-core.c
index eab56c0aacd5..8f2042432c85 100644
--- a/drivers/input/ff-core.c
+++ b/drivers/input/ff-core.c
@@ -318,6 +318,11 @@ int input_ff_create(struct input_dev *dev, unsigned int max_effects)
                 return -EINVAL;
         }
 
+        if (max_effects > FF_MAX_EFFECTS) {
+                dev_err(&dev->dev, "cannot allocate more than FF_MAX_EFFECTS effects\n");
+                return -EINVAL;
+        }
+
         ff_dev_size = sizeof(struct ff_device) +
                                 max_effects * sizeof(struct file *);
         if (ff_dev_size < max_effects) /* overflow */
diff --git a/include/uapi/linux/input.h b/include/uapi/linux/input.h
index a8e74b45dbe2..4f9f2a0f5573 100644
--- a/include/uapi/linux/input.h
+++ b/include/uapi/linux/input.h
@@ -414,6 +414,14 @@ struct ff_effect {
 #define FF_GAIN         0x60
 #define FF_AUTOCENTER   0x61
 
+/*
+ * ff->playback(effect_id = FF_GAIN) is the first effect_id to
+ * cause a collision with another ff method, in this case ff->set_gain().
+ * Therefore the greatest safe value for effect_id is FF_GAIN - 1,
+ * and thus the total number of effects should never exceed FF_GAIN.
+ */
+#define FF_MAX_EFFECTS  FF_GAIN
+
 #define FF_MAX          0x7f
 #define FF_CNT          (FF_MAX+1)