diff options
| author | John W. Linville <linville@tuxdriver.com> | 2011-11-22 23:05:46 +0400 |
|---|---|---|
| committer | John W. Linville <linville@tuxdriver.com> | 2011-11-22 23:05:46 +0400 |
| commit | 515db09338704a6ad7d27b5f1e33820d3052edd2 (patch) | |
| tree | 74f915531710303397d34069b325c2be7a5ac93c /drivers/input/ff-core.c | |
| parent | 30be52e44fd4276d768efffb55d424fb682e6505 (diff) | |
| parent | cfcfc9eca2bcbd26a8e206baeb005b055dbf8e37 (diff) | |
| download | linux-515db09338704a6ad7d27b5f1e33820d3052edd2.tar.xz | |
Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux
Conflicts:
drivers/net/wireless/iwlegacy/iwl-debugfs.c
drivers/net/wireless/iwlegacy/iwl-rx.c
drivers/net/wireless/iwlegacy/iwl-scan.c
drivers/net/wireless/iwlegacy/iwl-tx.c
include/net/bluetooth/bluetooth.h
Diffstat (limited to 'drivers/input/ff-core.c')
| -rw-r--r-- | drivers/input/ff-core.c | 11 |
1 files changed, 8 insertions, 3 deletions
diff --git a/drivers/input/ff-core.c b/drivers/input/ff-core.c index 3367f760d75a..480eb9d9876a 100644 --- a/drivers/input/ff-core.c +++ b/drivers/input/ff-core.c @@ -309,9 +309,10 @@ EXPORT_SYMBOL_GPL(input_ff_event); * Once ff device is created you need to setup its upload, erase, * playback and other handlers before registering input device */ -int input_ff_create(struct input_dev *dev, int max_effects) +int input_ff_create(struct input_dev *dev, unsigned int max_effects) { struct ff_device *ff; + size_t ff_dev_size; int i; if (!max_effects) { @@ -319,8 +320,12 @@ int input_ff_create(struct input_dev *dev, int max_effects) return -EINVAL; } - ff = kzalloc(sizeof(struct ff_device) + - max_effects * sizeof(struct file *), GFP_KERNEL); + ff_dev_size = sizeof(struct ff_device) + + max_effects * sizeof(struct file *); + if (ff_dev_size < max_effects) /* overflow */ + return -EINVAL; + + ff = kzalloc(ff_dev_size, GFP_KERNEL); if (!ff) return -ENOMEM; |