aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--drivers/char/keyboard.c4
-rw-r--r--drivers/input/evdev.c1
2 files changed, 3 insertions, 2 deletions
diff --git a/drivers/char/keyboard.c b/drivers/char/keyboard.c
index 7b19e02f112..523fd3c8bba 100644
--- a/drivers/char/keyboard.c
+++ b/drivers/char/keyboard.c
@@ -198,10 +198,10 @@ int setkeycode(unsigned int scancode, unsigned int keycode)
if (scancode >= dev->keycodemax)
return -EINVAL;
- if (keycode > KEY_MAX)
- return -EINVAL;
if (keycode < 0 || keycode > KEY_MAX)
return -EINVAL;
+ if (keycode >> (dev->keycodesize * 8))
+ return -EINVAL;
oldkey = SET_INPUT_KEYCODE(dev, scancode, keycode);
diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c
index 374f404e81d..20e3a165989 100644
--- a/drivers/input/evdev.c
+++ b/drivers/input/evdev.c
@@ -320,6 +320,7 @@ static long evdev_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
if (t < 0 || t >= dev->keycodemax || !dev->keycodesize) return -EINVAL;
if (get_user(v, ip + 1)) return -EFAULT;
if (v < 0 || v > KEY_MAX) return -EINVAL;
+ if (v >> (dev->keycodesize * 8)) return -EINVAL;
u = SET_INPUT_KEYCODE(dev, t, v);
clear_bit(u, dev->keybit);
set_bit(v, dev->keybit);