From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 906EFC33C8C for ; Tue, 19 Nov 2019 06:01:25 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 60E4020872 for ; Tue, 19 Nov 2019 06:01:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1574143285; bh=amUHA5skxMFyHpZaiRExuZqhDi9OXGgFqcXgRdef9rQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=X7GjsPsJCa3/W/ppNXacuni14iNthFrjmvy6V8GjJqgpwYv59tEcrwaxfnSFOm57m YphI45dkMGqZwAVZlwqND6h8x4MrQa2Yt28dFFIOXXZch7U5UNZYNndm7C1+OohvFs 2bnZEgcAFngUl8L3m5a/0m5+pljOO/VbjwzPcCI4= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730806AbfKSFoF (ORCPT ); Tue, 19 Nov 2019 00:44:05 -0500 Received: from mail.kernel.org ([198.145.29.99]:39354 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730804AbfKSFoE (ORCPT ); Tue, 19 Nov 2019 00:44:04 -0500 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id C409121939; Tue, 19 Nov 2019 05:44:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1574142244; bh=amUHA5skxMFyHpZaiRExuZqhDi9OXGgFqcXgRdef9rQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=CUwiCLrG8BY8nmnD3TcAjLfy0UpgrsLBnCO1Y7pjFOgvdbPuL/qK6cMz+YEZvbQpo DF5BwkpM0SW3jQCRbf1AlIZarLr91fia+UUAzq5eZ5ryg/iwiubBvqk9ebv8X3t2D1 rSl2az9vAFWgFt/Hnk0CLKRKeeUNC9OBdNLTWtDQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Andrew Duggan , Dmitry Torokhov Subject: [PATCH 4.14 016/239] Input: synaptics-rmi4 - do not consume more data than we have (F11, F12) Date: Tue, 19 Nov 2019 06:16:56 +0100 Message-Id: <20191119051300.922504819@linuxfoundation.org> X-Mailer: git-send-email 2.24.0 In-Reply-To: <20191119051255.850204959@linuxfoundation.org> References: <20191119051255.850204959@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Andrew Duggan commit 5d40d95e7e64756cc30606c2ba169271704d47cb upstream. Currently, rmi_f11_attention() and rmi_f12_attention() functions update the attn_data data pointer and size based on the size of the expected size of the attention data. However, if the actual valid data in the attn buffer is less then the expected value then the updated data pointer will point to memory beyond the end of the attn buffer. Using the calculated valid_bytes instead will prevent this from happening. Signed-off-by: Andrew Duggan Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20191025002527.3189-3-aduggan@synaptics.com Signed-off-by: Dmitry Torokhov Signed-off-by: Greg Kroah-Hartman --- drivers/input/rmi4/rmi_f11.c | 4 ++-- drivers/input/rmi4/rmi_f12.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) --- a/drivers/input/rmi4/rmi_f11.c +++ b/drivers/input/rmi4/rmi_f11.c @@ -1295,8 +1295,8 @@ static int rmi_f11_attention(struct rmi_ valid_bytes = f11->sensor.attn_size; memcpy(f11->sensor.data_pkt, drvdata->attn_data.data, valid_bytes); - drvdata->attn_data.data += f11->sensor.attn_size; - drvdata->attn_data.size -= f11->sensor.attn_size; + drvdata->attn_data.data += valid_bytes; + drvdata->attn_data.size -= valid_bytes; } else { error = rmi_read_block(rmi_dev, data_base_addr, f11->sensor.data_pkt, --- a/drivers/input/rmi4/rmi_f12.c +++ b/drivers/input/rmi4/rmi_f12.c @@ -217,8 +217,8 @@ static int rmi_f12_attention(struct rmi_ valid_bytes = sensor->attn_size; memcpy(sensor->data_pkt, drvdata->attn_data.data, valid_bytes); - drvdata->attn_data.data += sensor->attn_size; - drvdata->attn_data.size -= sensor->attn_size; + drvdata->attn_data.data += valid_bytes; + drvdata->attn_data.size -= valid_bytes; } else { retval = rmi_read_block(rmi_dev, f12->data_addr, sensor->data_pkt, sensor->pkt_size);