1 files changed, 80 insertions, 20 deletions

diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c
index 535fea4fe67f..e3f7fc6f9565 100644
--- a/drivers/input/evdev.c
+++ b/drivers/input/evdev.c
@@ -534,6 +534,80 @@ static int handle_eviocgbit(struct input_dev *dev,
 }
 #undef OLD_KEY_MAX
 
+static int evdev_handle_get_keycode(struct input_dev *dev,
+                                    void __user *p, size_t size)
+{
+        struct input_keymap_entry ke;
+        int error;
+
+        memset(&ke, 0, sizeof(ke));
+
+        if (size == sizeof(unsigned int[2])) {
+                /* legacy case */
+                int __user *ip = (int __user *)p;
+
+                if (copy_from_user(ke.scancode, p, sizeof(unsigned int)))
+                        return -EFAULT;
+
+                ke.len = sizeof(unsigned int);
+                ke.flags = 0;
+
+                error = input_get_keycode(dev, &ke);
+                if (error)
+                        return error;
+
+                if (put_user(ke.keycode, ip + 1))
+                        return -EFAULT;
+
+        } else {
+                size = min(size, sizeof(ke));
+
+                if (copy_from_user(&ke, p, size))
+                        return -EFAULT;
+
+                error = input_get_keycode(dev, &ke);
+                if (error)
+                        return error;
+
+                if (copy_to_user(p, &ke, size))
+                        return -EFAULT;
+        }
+        return 0;
+}
+
+static int evdev_handle_set_keycode(struct input_dev *dev,
+                                    void __user *p, size_t size)
+{
+        struct input_keymap_entry ke;
+
+        memset(&ke, 0, sizeof(ke));
+
+        if (size == sizeof(unsigned int[2])) {
+                /* legacy case */
+                int __user *ip = (int __user *)p;
+
+                if (copy_from_user(ke.scancode, p, sizeof(unsigned int)))
+                        return -EFAULT;
+
+                if (get_user(ke.keycode, ip + 1))
+                        return -EFAULT;
+
+                ke.len = sizeof(unsigned int);
+                ke.flags = 0;
+
+        } else {
+                size = min(size, sizeof(ke));
+
+                if (copy_from_user(&ke, p, size))
+                        return -EFAULT;
+
+                if (ke.len > sizeof(ke.scancode))
+                        return -EINVAL;
+        }
+
+        return input_set_keycode(dev, &ke);
+}
+
 static long evdev_do_ioctl(struct file *file, unsigned int cmd,
                            void __user *p, int compat_mode)
 {
@@ -580,25 +654,6 @@ static long evdev_do_ioctl(struct file *file, unsigned int cmd,
 
                 return 0;
 
-        case EVIOCGKEYCODE:
-                if (get_user(t, ip))
-                        return -EFAULT;
-
-                error = input_get_keycode(dev, t, &v);
-                if (error)
-                        return error;
-
-                if (put_user(v, ip + 1))
-                        return -EFAULT;
-
-                return 0;
-
-        case EVIOCSKEYCODE:
-                if (get_user(t, ip) || get_user(v, ip + 1))
-                        return -EFAULT;
-
-                return input_set_keycode(dev, t, v);
-
         case EVIOCRMFF:
                 return input_ff_erase(dev, (int)(unsigned long) p, file);
 
@@ -620,7 +675,6 @@ static long evdev_do_ioctl(struct file *file, unsigned int cmd,
 
         /* Now check variable-length commands */
 #define EVIOC_MASK_SIZE(nr)     ((nr) & ~(_IOC_SIZEMASK << _IOC_SIZESHIFT))
-
         switch (EVIOC_MASK_SIZE(cmd)) {
 
         case EVIOCGKEY(0):
@@ -654,6 +708,12 @@ static long evdev_do_ioctl(struct file *file, unsigned int cmd,
                         return -EFAULT;
 
                 return error;
+
+        case EVIOC_MASK_SIZE(EVIOCGKEYCODE):
+                return evdev_handle_get_keycode(dev, p, size);
+
+        case EVIOC_MASK_SIZE(EVIOCSKEYCODE):
+                return evdev_handle_set_keycode(dev, p, size);
         }
 
         /* Multi-number variable-length handlers */