From: Andrew Duggan <aduggan@synaptics.com>
To: "linux-input@vger.kernel.org" <linux-input@vger.kernel.org>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Cc: Andrew Duggan <aduggan@synaptics.com>,
Dmitry Torokhov <dmitry.torokhov@gmail.com>,
Benjamin Tissoires <benjamin.tissoires@redhat.com>,
Christopher Heiny <Cheiny@synaptics.com>,
Simon Wood <simon@mungewell.org>, Nick Dyer <nick@shmanahar.org>
Subject: [PATCH 2/3] Input: synaptics-rmi4 - use the number of valid bytes read when updating the attn_data fields in F11 and F12
Date: Fri, 25 Oct 2019 00:25:58 +0000 [thread overview]
Message-ID: <20191025002527.3189-3-aduggan@synaptics.com> (raw)
In-Reply-To: <20191025002527.3189-1-aduggan@synaptics.com>
Currently, rmi_f11_attention() and rmi_f12_attention() functions update
the attn_data data pointer and size based on the size of the expected
size of the attention data. However, if the actual valid data in the
attn buffer is less then the expected value then the updated data
pointer will point to memory beyond the end of the attn buffer. Using
the calculated valid_bytes instead will prevent this from happening.
Signed-off-by: Andrew Duggan <aduggan@synaptics.com>
---
drivers/input/rmi4/rmi_f11.c | 4 ++--
drivers/input/rmi4/rmi_f12.c | 4 ++--
2 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/input/rmi4/rmi_f11.c b/drivers/input/rmi4/rmi_f11.c
index f28a7158b2ef..26c239325f95 100644
--- a/drivers/input/rmi4/rmi_f11.c
+++ b/drivers/input/rmi4/rmi_f11.c
@@ -1284,8 +1284,8 @@ static irqreturn_t rmi_f11_attention(int irq, void *ctx)
valid_bytes = f11->sensor.attn_size;
memcpy(f11->sensor.data_pkt, drvdata->attn_data.data,
valid_bytes);
- drvdata->attn_data.data += f11->sensor.attn_size;
- drvdata->attn_data.size -= f11->sensor.attn_size;
+ drvdata->attn_data.data += valid_bytes;
+ drvdata->attn_data.size -= valid_bytes;
} else {
error = rmi_read_block(rmi_dev,
data_base_addr, f11->sensor.data_pkt,
diff --git a/drivers/input/rmi4/rmi_f12.c b/drivers/input/rmi4/rmi_f12.c
index 734077f2c40b..7e97944f7616 100644
--- a/drivers/input/rmi4/rmi_f12.c
+++ b/drivers/input/rmi4/rmi_f12.c
@@ -212,8 +212,8 @@ static irqreturn_t rmi_f12_attention(int irq, void *ctx)
valid_bytes = sensor->attn_size;
memcpy(sensor->data_pkt, drvdata->attn_data.data,
valid_bytes);
- drvdata->attn_data.data += sensor->attn_size;
- drvdata->attn_data.size -= sensor->attn_size;
+ drvdata->attn_data.data += valid_bytes;
+ drvdata->attn_data.size -= valid_bytes;
} else {
retval = rmi_read_block(rmi_dev, f12->data_addr,
sensor->data_pkt, sensor->pkt_size);
--
2.20.1
next prev parent reply other threads:[~2019-10-25 0:26 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-10-25 0:25 [PATCH 0/3] Fix spurious button presses for some HID touchpads Andrew Duggan
2019-10-25 0:25 ` [PATCH 1/3] Input: synaptics-rmi4 - disable the relative position IRQ in the F12 driver Andrew Duggan
2019-10-28 5:39 ` Dmitry Torokhov
2019-10-29 19:54 ` Andrew Duggan
2019-10-25 0:25 ` Andrew Duggan [this message]
2019-10-25 0:26 ` [PATCH 3/3] Input: synaptics-rmi4 - remove unused result_bits mask Andrew Duggan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20191025002527.3189-3-aduggan@synaptics.com \
--to=aduggan@synaptics.com \
--cc=Cheiny@synaptics.com \
--cc=benjamin.tissoires@redhat.com \
--cc=dmitry.torokhov@gmail.com \
--cc=linux-input@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=nick@shmanahar.org \
--cc=simon@mungewell.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.