linux-kernel - Re: [PATCH (resend)] Input: MT

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAHk-=whH+xp7ZxqgwOEm=_H=fVpWQvWpPqK6gzcPt8xdEXzwrg@mail.gmail.com>
Date: Mon, 29 Jul 2024 13:14:36 -0700
From: Linus Torvalds <torvalds@...ux-foundation.org>
To: Dmitry Torokhov <dmitry.torokhov@...il.com>
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>, 
	Tetsuo Handa <penguin-kernel@...ove.sakura.ne.jp>, Henrik Rydberg <rydberg@...math.org>, 
	"linux-input@...r.kernel.org" <linux-input@...r.kernel.org>, LKML <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH (resend)] Input: MT - limit max slots

On Mon, 29 Jul 2024 at 13:00, Dmitry Torokhov <dmitry.torokhov@...il.com> wrote:
>
> Hmm, maybe the checks should go into drivers/input/misc/uinput.c which
> is the only place that allows userspace to create input device instances
> and drive them rather than into input core logic because all other
> devices are backed by real hardware.

Ack, that sounds like a good idea, particularly if there is some
single location that could validate the input.

uinput_validate_absinfo(), perhaps?

We do end up trying to protect against some forms of bad hardware too
when possible, but realistically _that_ kind of protection should be
more along the lines of "don't cause security issues".

            Linus