aboutsummaryrefslogtreecommitdiffstats
path: root/drivers
diff options
context:
space:
mode:
Diffstat (limited to 'drivers')
-rw-r--r--drivers/input/misc/uinput.c13
1 files changed, 6 insertions, 7 deletions
diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c
index 82542a1c1098..c0888e3d2fb4 100644
--- a/drivers/input/misc/uinput.c
+++ b/drivers/input/misc/uinput.c
@@ -347,8 +347,7 @@ static int uinput_setup_device(struct uinput_device *udev, const char __user *bu
347{ 347{
348 struct uinput_user_dev *user_dev; 348 struct uinput_user_dev *user_dev;
349 struct input_dev *dev; 349 struct input_dev *dev;
350 char *name; 350 int i;
351 int i, size;
352 int retval; 351 int retval;
353 352
354 if (count != sizeof(struct uinput_user_dev)) 353 if (count != sizeof(struct uinput_user_dev))
@@ -373,19 +372,19 @@ static int uinput_setup_device(struct uinput_device *udev, const char __user *bu
373 372
374 udev->ff_effects_max = user_dev->ff_effects_max; 373 udev->ff_effects_max = user_dev->ff_effects_max;
375 374
376 size = strnlen(user_dev->name, UINPUT_MAX_NAME_SIZE) + 1; 375 /* Ensure name is filled in */
377 if (!size) { 376 if (!user_dev->name[0]) {
378 retval = -EINVAL; 377 retval = -EINVAL;
379 goto exit; 378 goto exit;
380 } 379 }
381 380
382 kfree(dev->name); 381 kfree(dev->name);
383 dev->name = name = kmalloc(size, GFP_KERNEL); 382 dev->name = kstrndup(user_dev->name, UINPUT_MAX_NAME_SIZE,
384 if (!name) { 383 GFP_KERNEL);
384 if (!dev->name) {
385 retval = -ENOMEM; 385 retval = -ENOMEM;
386 goto exit; 386 goto exit;
387 } 387 }
388 strlcpy(name, user_dev->name, size);
389 388
390 dev->id.bustype = user_dev->id.bustype; 389 dev->id.bustype = user_dev->id.bustype;
391 dev->id.vendor = user_dev->id.vendor; 390 dev->id.vendor = user_dev->id.vendor;