mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-15 23:25:07 +00:00
Input: synaptics-rmi4 - do not consume more data than we have (F11, F12)
commit 5d40d95e7e
upstream.
Currently, rmi_f11_attention() and rmi_f12_attention() functions update
the attn_data data pointer and size based on the size of the expected
size of the attention data. However, if the actual valid data in the
attn buffer is less then the expected value then the updated data
pointer will point to memory beyond the end of the attn buffer. Using
the calculated valid_bytes instead will prevent this from happening.
Signed-off-by: Andrew Duggan <aduggan@synaptics.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20191025002527.3189-3-aduggan@synaptics.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
924a8f2c74
commit
fbe9849f79
2 changed files with 4 additions and 4 deletions
|
@ -1287,8 +1287,8 @@ static irqreturn_t rmi_f11_attention(int irq, void *ctx)
|
|||
valid_bytes = f11->sensor.attn_size;
|
||||
memcpy(f11->sensor.data_pkt, drvdata->attn_data.data,
|
||||
valid_bytes);
|
||||
drvdata->attn_data.data += f11->sensor.attn_size;
|
||||
drvdata->attn_data.size -= f11->sensor.attn_size;
|
||||
drvdata->attn_data.data += valid_bytes;
|
||||
drvdata->attn_data.size -= valid_bytes;
|
||||
} else {
|
||||
error = rmi_read_block(rmi_dev,
|
||||
data_base_addr, f11->sensor.data_pkt,
|
||||
|
|
|
@ -217,8 +217,8 @@ static irqreturn_t rmi_f12_attention(int irq, void *ctx)
|
|||
valid_bytes = sensor->attn_size;
|
||||
memcpy(sensor->data_pkt, drvdata->attn_data.data,
|
||||
valid_bytes);
|
||||
drvdata->attn_data.data += sensor->attn_size;
|
||||
drvdata->attn_data.size -= sensor->attn_size;
|
||||
drvdata->attn_data.data += valid_bytes;
|
||||
drvdata->attn_data.size -= valid_bytes;
|
||||
} else {
|
||||
retval = rmi_read_block(rmi_dev, f12->data_addr,
|
||||
sensor->data_pkt, sensor->pkt_size);
|
||||
|
|
Loading…
Reference in a new issue