X-Git-Url: https://git.openpandora.org/cgi-bin/gitweb.cgi?a=blobdiff_plain;f=drivers%2Finput%2Fevdev.c;h=7f42d3a454d2d6aaebdc41e0e5a8c6700d6a00df;hb=e28e1d93e9591d21e440f5210a9b4317c59445df;hp=c8471a2552e73ea28c7401e58e713b66bbc6cc33;hpb=7f42f9fef7bbc4f3250a33bf58170c640cd3db18;p=pandora-kernel.git

diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c
index c8471a2552e7..7f42d3a454d2 100644
--- a/drivers/input/evdev.c
+++ b/drivers/input/evdev.c
@@ -321,6 +321,9 @@ static ssize_t evdev_write(struct file *file, const char __user *buffer,
 	struct input_event event;
 	int retval;
 
+	if (count < input_event_size())
+		return -EINVAL;
+
 	retval = mutex_lock_interruptible(&evdev->mutex);
 	if (retval)
 		return retval;
@@ -330,17 +333,16 @@ static ssize_t evdev_write(struct file *file, const char __user *buffer,
 		goto out;
 	}
 
-	while (retval < count) {
-
+	do {
 		if (input_event_from_user(buffer + retval, &event)) {
 			retval = -EFAULT;
 			goto out;
 		}
+		retval += input_event_size();
 
 		input_inject_event(&evdev->handle,
 				   event.type, event.code, event.value);
-		retval += input_event_size();
-	}
+	} while (retval + input_event_size() <= count);
 
  out:
 	mutex_unlock(&evdev->mutex);