From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
To: linux-input@vger.kernel.org
Cc: Marge Yang <Marge.Yang@tw.synaptics.com>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
linux-kernel@vger.kernel.org, stable@vger.kernel.org
Subject: [PATCH v2 01/20] Input: rmi4 - fix register descriptor address calculation
Date: Mon, 4 May 2026 21:59:31 -0700 [thread overview]
Message-ID: <20260505045952.1570713-1-dmitry.torokhov@gmail.com> (raw)
When reading the register descriptor, the base address is incremented by
1 to read the presence register block. However, after reading the
presence register block, the address is incorrectly incremented by only
1 byte (++addr) instead of the actual size of the presence block
(size_presence_reg). This causes the subsequent structure block read to
read from the wrong memory location if the presence block is larger than
1 byte.
Fix this by advancing the address by size_presence_reg.
Fixes: 2b6a321da9a2 ("Input: synaptics-rmi4 - add support for Synaptics RMI4 devices")
Cc: stable@vger.kernel.org
Assisted-by: Gemini:gemini-3.1-pro
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---
v2 of the series: added a bunch of new patches.
drivers/input/rmi4/rmi_driver.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/input/rmi4/rmi_driver.c b/drivers/input/rmi4/rmi_driver.c
index ccd9338a44db..06f5e3000cf0 100644
--- a/drivers/input/rmi4/rmi_driver.c
+++ b/drivers/input/rmi4/rmi_driver.c
@@ -594,7 +594,7 @@ int rmi_read_register_desc(struct rmi_device *d, u16 addr,
ret = rmi_read_block(d, addr, buf, size_presence_reg);
if (ret)
return ret;
- ++addr;
+ addr += size_presence_reg;
if (buf[0] == 0) {
presense_offset = 3;
--
2.54.0.545.g6539524ca2-goog
next reply other threads:[~2026-05-05 4:59 UTC|newest]
Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-05-05 4:59 Dmitry Torokhov [this message]
2026-05-05 4:59 ` [PATCH v2 02/20] Input: rmi4 - refactor register descriptor parsing Dmitry Torokhov
2026-05-05 4:59 ` [PATCH v2 03/20] Input: rmi4 - fix type overflow in register counts Dmitry Torokhov
2026-05-05 4:59 ` [PATCH v2 04/20] Input: rmi4 - fix num_subpackets overflow in register descriptor Dmitry Torokhov
2026-05-05 4:59 ` [PATCH v2 05/20] Input: rmi4 - fix memory leak in rmi_set_attn_data() Dmitry Torokhov
2026-05-05 4:59 ` [PATCH v2 06/20] Input: rmi4 - iterative IRQ handler Dmitry Torokhov
2026-05-05 4:59 ` [PATCH v2 07/20] Input: rmi4 - fix bit count in bitmap_copy() Dmitry Torokhov
2026-05-05 4:59 ` [PATCH v2 08/20] Input: rmi4 - fix limit in rmi_register_desc_has_subpacket() Dmitry Torokhov
2026-05-05 4:59 ` [PATCH v2 09/20] Input: rmi4 - use local presence map in rmi_read_register_desc() Dmitry Torokhov
2026-05-05 4:59 ` [PATCH v2 10/20] Input: rmi4 - refactor function allocation and registration Dmitry Torokhov
2026-05-05 4:59 ` [PATCH v2 11/20] Input: rmi4 - use kzalloc_flex() for struct rmi_function Dmitry Torokhov
2026-05-05 4:59 ` [PATCH v2 12/20] Input: rmi4 - refactor F12 probe function Dmitry Torokhov
2026-05-05 4:59 ` [PATCH v2 13/20] Input: rmi4 - change reg_size type to u32 Dmitry Torokhov
2026-05-05 4:59 ` [PATCH v2 14/20] Input: rmi4 - use unaligned access helpers in F12 Dmitry Torokhov
2026-05-05 4:59 ` [PATCH v2 15/20] Input: rmi4 - use flexible array member for IRQ masks " Dmitry Torokhov
2026-05-05 4:59 ` [PATCH v2 16/20] Input: rmi4 - use devm_kmalloc for F12 data packet buffer Dmitry Torokhov
2026-05-05 4:59 ` [PATCH v2 17/20] Input: rmi4 - use sizeof(*ptr) and idiomatic checks in f12 allocators Dmitry Torokhov
2026-05-05 4:59 ` [PATCH v2 18/20] Input: rmi4 - simplify size calculations in F12 Dmitry Torokhov
2026-05-05 4:59 ` [PATCH v2 19/20] Input: rmi4 - propagate proper error code in F12 sensor tuning Dmitry Torokhov
2026-05-05 4:59 ` [PATCH v2 20/20] Input: rmi4 - update formatting in F12 Dmitry Torokhov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260505045952.1570713-1-dmitry.torokhov@gmail.com \
--to=dmitry.torokhov@gmail.com \
--cc=Marge.Yang@tw.synaptics.com \
--cc=gregkh@linuxfoundation.org \
--cc=linux-input@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox