Input: joydev - prevent use of not validated data in JSIOCSBTNMAP ioctl

Even though we validate user-provided inputs we then traverse past
validated data when applying the new map. The issue was originally
discovered by Murray McAllister with this simple POC (if the following
is executed by an unprivileged user it will instantly panic the system):

int main(void) {
	int fd, ret;
	unsigned int buffer[10000];

	fd = open("/dev/input/js0", O_RDONLY);
	if (fd == -1)
		printf("Error opening file\n");

	ret = ioctl(fd, JSIOCSBTNMAP & ~IOCSIZE_MASK, &buffer);
	printf("%d\n", ret);
}

The solution is to traverse internal buffer which is guaranteed to only
contain valid date when constructing the map.

Fixes: e87cdafb472e ("Input: joydev - prevent potential read overflow in ioctl")
Fixes: 2e9f4bbf3889 ("Input: joydev - validate axis/button maps before clobbering current ones")
Reported-by: Murray McAllister <murray.mcallister@gmail.com>
Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Alexander Larkin <avlarkin82@gmail.com>
Link: https://lore.kernel.org/r/20210620120030.1513655-1-avlarkin82@gmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

diff --git a/drivers/input/joydev.c b/drivers/input/joydev.c
index da8963a9f044cb68e7230c4ec4da450b22e41a7f..947d440a3be635e0470f69dacf8e4cb523fffc60 100644 (file)
--- a/drivers/input/joydev.c
+++ b/drivers/input/joydev.c
@@ -499,7 +499,7 @@ static int joydev_handle_JSIOCSBTNMAP(struct joydev *joydev,
        memcpy(joydev->keypam, keypam, len);
 
        for (i = 0; i < joydev->nkey; i++)
-               joydev->keymap[keypam[i] - BTN_MISC] = i;
+               joydev->keymap[joydev->keypam[i] - BTN_MISC] = i;
 
  out:
        kfree(keypam);