1 files changed, 9 insertions, 3 deletions

diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c
index c238116400b3..114efd8dc8f5 100644
--- a/drivers/input/evdev.c
+++ b/drivers/input/evdev.c
@@ -626,8 +626,11 @@ static long evdev_do_ioctl(struct file *file, unsigned int cmd,
                                 abs.maximum = dev->absmax[t];
                                 abs.fuzz = dev->absfuzz[t];
                                 abs.flat = dev->absflat[t];
+                                abs.resolution = dev->absres[t];
 
-                                if (copy_to_user(p, &abs, sizeof(struct input_absinfo)))
+                                if (copy_to_user(p, &abs, min_t(size_t,
+                                                                _IOC_SIZE(cmd),
+                                                                sizeof(struct input_absinfo))))
                                         return -EFAULT;
 
                                 return 0;
@@ -654,8 +657,9 @@ static long evdev_do_ioctl(struct file *file, unsigned int cmd,
 
                                 t = _IOC_NR(cmd) & ABS_MAX;
 
-                                if (copy_from_user(&abs, p,
-                                                sizeof(struct input_absinfo)))
+                                if (copy_from_user(&abs, p, min_t(size_t,
+                                                                  _IOC_SIZE(cmd),
+                                                                  sizeof(struct input_absinfo))))
                                         return -EFAULT;
 
                                 /*
@@ -670,6 +674,8 @@ static long evdev_do_ioctl(struct file *file, unsigned int cmd,
                                 dev->absmax[t] = abs.maximum;
                                 dev->absfuzz[t] = abs.fuzz;
                                 dev->absflat[t] = abs.flat;
+                                dev->absres[t] = _IOC_SIZE(cmd) < sizeof(struct input_absinfo) ?
+                                                        0 : abs.resolution;
 
                                 spin_unlock_irq(&dev->event_lock);