Merge branch 'x86-spinlocks-for-linus' of git://git.kernel.org/pub/scm/linux/kernel...

[pandora-kernel.git] / drivers / input / ff-core.c

diff --git a/drivers/input/ff-core.c b/drivers/input/ff-core.c
index 3367f76..480eb9d 100644 (file)
--- a/drivers/input/ff-core.c
+++ b/drivers/input/ff-core.c
@@ -309,9 +309,10 @@ EXPORT_SYMBOL_GPL(input_ff_event);
  * Once ff device is created you need to setup its upload, erase,
  * playback and other handlers before registering input device
  */
-int input_ff_create(struct input_dev *dev, int max_effects)
+int input_ff_create(struct input_dev *dev, unsigned int max_effects)
 {
        struct ff_device *ff;
+       size_t ff_dev_size;
        int i;
 
        if (!max_effects) {
@@ -319,8 +320,12 @@ int input_ff_create(struct input_dev *dev, int max_effects)
                return -EINVAL;
        }
 
-       ff = kzalloc(sizeof(struct ff_device) +
-                    max_effects * sizeof(struct file *), GFP_KERNEL);
+       ff_dev_size = sizeof(struct ff_device) +
+                               max_effects * sizeof(struct file *);
+       if (ff_dev_size < max_effects) /* overflow */
+               return -EINVAL;
+
+       ff = kzalloc(ff_dev_size, GFP_KERNEL);
        if (!ff)
                return -ENOMEM;