diff --git a/drivers/input/input-mt.c b/drivers/input/input-mt.c index 44fe6f2f063ce45cc7d6830881e2cdf01d30495b..d0f8c31d7cc04fff714dd62a17430e58c526860a 100644 --- a/drivers/input/input-mt.c +++ b/drivers/input/input-mt.c @@ -45,6 +45,9 @@ int input_mt_init_slots(struct input_dev *dev, unsigned int num_slots, return 0; if (mt) return mt->num_slots != num_slots ? -EINVAL : 0; + /* Arbitrary limit for avoiding too large memory allocation. */ + if (num_slots > 1024) + return -EINVAL; mt = kzalloc(struct_size(mt, slots, num_slots), GFP_KERNEL); if (!mt)