diff options
-rw-r--r-- | drivers/input/evdev.c | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c index 1ce9bf663206..b9723c735c67 100644 --- a/drivers/input/evdev.c +++ b/drivers/input/evdev.c | |||
@@ -729,6 +729,9 @@ static long evdev_do_ioctl(struct file *file, unsigned int cmd, | |||
729 | 729 | ||
730 | if ((_IOC_NR(cmd) & ~ABS_MAX) == _IOC_NR(EVIOCGABS(0))) { | 730 | if ((_IOC_NR(cmd) & ~ABS_MAX) == _IOC_NR(EVIOCGABS(0))) { |
731 | 731 | ||
732 | if (!dev->absinfo) | ||
733 | return -EINVAL; | ||
734 | |||
732 | t = _IOC_NR(cmd) & ABS_MAX; | 735 | t = _IOC_NR(cmd) & ABS_MAX; |
733 | abs = dev->absinfo[t]; | 736 | abs = dev->absinfo[t]; |
734 | 737 | ||
@@ -740,10 +743,13 @@ static long evdev_do_ioctl(struct file *file, unsigned int cmd, | |||
740 | } | 743 | } |
741 | } | 744 | } |
742 | 745 | ||
743 | if (_IOC_DIR(cmd) == _IOC_READ) { | 746 | if (_IOC_DIR(cmd) == _IOC_WRITE) { |
744 | 747 | ||
745 | if ((_IOC_NR(cmd) & ~ABS_MAX) == _IOC_NR(EVIOCSABS(0))) { | 748 | if ((_IOC_NR(cmd) & ~ABS_MAX) == _IOC_NR(EVIOCSABS(0))) { |
746 | 749 | ||
750 | if (!dev->absinfo) | ||
751 | return -EINVAL; | ||
752 | |||
747 | t = _IOC_NR(cmd) & ABS_MAX; | 753 | t = _IOC_NR(cmd) & ABS_MAX; |
748 | 754 | ||
749 | if (copy_from_user(&abs, p, min_t(size_t, | 755 | if (copy_from_user(&abs, p, min_t(size_t, |