diff --git a/drivers/input/input-mt.c b/drivers/input/input-mt.c index 6c7326c93721c495c4e61a73cac2dfaf9a5bc8fc..fd01c9306e66ce9d77c74748bffcae1546cb5298 100644 --- a/drivers/input/input-mt.c +++ b/drivers/input/input-mt.c @@ -48,6 +48,9 @@ int input_mt_init_slots(struct input_dev *dev, unsigned int num_slots, return 0; if (mt) return mt->num_slots != num_slots ? -EINVAL : 0; + /* Arbitrary limit for avoiding too large memory allocation. */ + if (num_slots > 1024) + return -EINVAL; mt = kzalloc(struct_size(mt, slots, num_slots), GFP_KERNEL); if (!mt)