Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 12af8915 authored by Venkata Prahlad Valluru's avatar Venkata Prahlad Valluru
Browse files

input: synaptics_dsx_2.6: Propagating security fixes from msm-3.18 



This commit is a squash of below security fixes from the
branch msm-3.18.

fc64cb5 touchscreen: synaptics_dsx_2.6: Remove fw_update sysfs entries
7aa4783 input: synaptics_dsx: reallocate buffer under lock.

Instead of using #ifdefs inside function, add conditionally
compiled functions.

Change-Id: I50f9800a27d7142779298d2ffa880df15b164353
Signed-off-by: default avatarVenkata Prahlad Valluru <vvalluru@codeaurora.org>
parent c24097ef

drivers/input/touchscreen/synaptics_dsx_2.6/synaptics_dsx_fw_update.c

+43 −4
Original line number Diff line number Diff line
@@ -128,6 +128,7 @@ static int fwu_do_reflash(void); 


static int fwu_recovery_check_status(void);



#ifdef CONFIG_TOUCHSCREEN_SYNAPTICS_DSX_FW_UPDATE_EXTRA_SYSFS

static ssize_t fwu_sysfs_show_image(struct file *data_file,

		struct kobject *kobj, struct bin_attribute *attributes,

		char *buf, loff_t pos, size_t count);
@@ -180,6 +181,7 @@ static ssize_t fwu_sysfs_guest_code_block_count_show(struct device *dev, 


static ssize_t fwu_sysfs_write_guest_code_store(struct device *dev,

		struct device_attribute *attr, const char *buf, size_t count);

#endif



enum f34_version {

	F34_V0 = 0,
@@ -651,6 +653,7 @@ struct synaptics_rmi4_fwu_handle { 
	struct work_struct fwu_work;

};



#ifdef CONFIG_TOUCHSCREEN_SYNAPTICS_DSX_FW_UPDATE_EXTRA_SYSFS

static struct bin_attribute dev_attr_data = {

	.attr = {

		.name = "data",
@@ -660,8 +663,10 @@ static struct bin_attribute dev_attr_data = { 
	.read = fwu_sysfs_show_image,

	.write = fwu_sysfs_store_image,

};

#endif



static struct device_attribute attrs[] = {

#ifdef CONFIG_TOUCHSCREEN_SYNAPTICS_DSX_FW_UPDATE_EXTRA_SYSFS

	__ATTR(dorecovery, 0220,

			NULL,

			fwu_sysfs_do_recovery_store),
@@ -707,6 +712,7 @@ static struct device_attribute attrs[] = { 
	__ATTR(writeguestcode, 0220,

			NULL,

			fwu_sysfs_write_guest_code_store),

#endif

};



static struct synaptics_rmi4_fwu_handle *fwu;
@@ -2609,6 +2615,7 @@ static int fwu_check_dp_configuration_size(void) 
	return 0;

}



#ifdef CONFIG_TOUCHSCREEN_SYNAPTICS_DSX_FW_UPDATE_EXTRA_SYSFS

static int fwu_check_pm_configuration_size(void)

{

	unsigned short block_count;
@@ -2625,6 +2632,7 @@ static int fwu_check_pm_configuration_size(void) 


	return 0;

}

#endif



static int fwu_check_bl_configuration_size(void)

{
@@ -2824,6 +2832,7 @@ static int fwu_write_dp_configuration(void) 
	return fwu_write_configuration();

}



#ifdef CONFIG_TOUCHSCREEN_SYNAPTICS_DSX_FW_UPDATE_EXTRA_SYSFS

static int fwu_write_pm_configuration(void)

{

	fwu->config_area = PM_CONFIG_AREA;
@@ -2833,6 +2842,7 @@ static int fwu_write_pm_configuration(void) 


	return fwu_write_configuration();

}

#endif



static int fwu_write_flash_configuration(void)

{
@@ -3040,6 +3050,7 @@ static int fwu_do_reflash(void) 
	return retval;

}



#ifdef CONFIG_TOUCHSCREEN_SYNAPTICS_DSX_FW_UPDATE_EXTRA_SYSFS

static int fwu_do_read_config(void)

{

	int retval;
@@ -3117,6 +3128,7 @@ static int fwu_do_read_config(void) 


	return retval;

}

#endif



static int fwu_do_lockdown_v7(void)

{
@@ -3191,6 +3203,7 @@ static int fwu_do_lockdown_v5v6(void) 
	return retval;

}



#ifdef CONFIG_TOUCHSCREEN_SYNAPTICS_DSX_FW_UPDATE_EXTRA_SYSFS

static int fwu_start_write_guest_code(void)

{

	int retval;
@@ -3396,6 +3409,7 @@ static int fwu_start_write_config(void) 


	return retval;

}

#endif



static int fwu_start_reflash(void)

{
@@ -3597,6 +3611,7 @@ static int fwu_recovery_check_status(void) 
	return 0;

}



#ifdef CONFIG_TOUCHSCREEN_SYNAPTICS_DSX_FW_UPDATE_EXTRA_SYSFS

static int fwu_recovery_erase_all(void)

{

	int retval;
@@ -3790,6 +3805,7 @@ static int fwu_start_recovery(void) 


	return retval;

}

#endif



int synaptics_fw_updater(const unsigned char *fw_data)

{
@@ -3848,6 +3864,7 @@ static void fwu_startup_fw_update_work(struct work_struct *work) 
}

#endif



#ifdef CONFIG_TOUCHSCREEN_SYNAPTICS_DSX_FW_UPDATE_EXTRA_SYSFS

static ssize_t fwu_sysfs_show_image(struct file *data_file,

		struct kobject *kobj, struct bin_attribute *attributes,

		char *buf, loff_t pos, size_t count)
@@ -4219,6 +4236,7 @@ static ssize_t fwu_sysfs_write_guest_code_store(struct device *dev, 
	fwu->image = NULL;

	return retval;

}

#endif



static void synaptics_rmi4_fwu_attn(struct synaptics_rmi4_data *rmi4_data,

		unsigned char intr_mask)
@@ -4232,6 +4250,28 @@ static void synaptics_rmi4_fwu_attn(struct synaptics_rmi4_data *rmi4_data, 
	return;

}



#ifdef CONFIG_TOUCHSCREEN_SYNAPTICS_DSX_FW_UPDATE_EXTRA_SYSFS

static int synaptics_create_fwu_bin_file(struct synaptics_rmi4_data *rmi4_data)

{

	return sysfs_create_bin_file(&rmi4_data->input_dev->dev.kobj,

			&dev_attr_data);

}



static void synaptics_remove_fwu_bin_file(struct synaptics_rmi4_data *rmi4_data)

{

	sysfs_remove_bin_file(&rmi4_data->input_dev->dev.kobj, &dev_attr_data);

}

#else

static int synaptics_create_fwu_bin_file(struct synaptics_rmi4_data *rmi4_data)

{

	return 0;

}



static void synaptics_remove_fwu_bin_file(struct synaptics_rmi4_data *rmi4_data)

{

}

#endif



static int synaptics_rmi4_fwu_init(struct synaptics_rmi4_data *rmi4_data)

{

	int retval;
@@ -4303,8 +4343,7 @@ static int synaptics_rmi4_fwu_init(struct synaptics_rmi4_data *rmi4_data) 
	fwu->do_lockdown = DO_LOCKDOWN;

	fwu->initialized = true;



	retval = sysfs_create_bin_file(&rmi4_data->input_dev->dev.kobj,

			&dev_attr_data);

	retval = synaptics_create_fwu_bin_file(rmi4_data);

	if (retval < 0) {

		dev_err(rmi4_data->pdev->dev.parent,

				"%s: Failed to create sysfs bin file\n",
@@ -4339,7 +4378,7 @@ static int synaptics_rmi4_fwu_init(struct synaptics_rmi4_data *rmi4_data) 
				&attrs[attr_count].attr);

	}



	sysfs_remove_bin_file(&rmi4_data->input_dev->dev.kobj, &dev_attr_data);

	synaptics_remove_fwu_bin_file(rmi4_data);



exit_free_mem:

	kfree(fwu->image_name);
@@ -4370,7 +4409,7 @@ static void synaptics_rmi4_fwu_remove(struct synaptics_rmi4_data *rmi4_data) 
				&attrs[attr_count].attr);

	}



	sysfs_remove_bin_file(&rmi4_data->input_dev->dev.kobj, &dev_attr_data);

	synaptics_remove_fwu_bin_file(rmi4_data);



	kfree(fwu->read_config_buf);

	kfree(fwu->image_name);

drivers/input/touchscreen/synaptics_dsx_2.6/synaptics_dsx_i2c.c

+3 −3
Original line number Diff line number Diff line
@@ -436,11 +436,11 @@ static int synaptics_rmi4_i2c_write(struct synaptics_rmi4_data *rmi4_data, 
	struct i2c_client *i2c = to_i2c_client(rmi4_data->pdev->dev.parent);

	struct i2c_msg msg[1];



	mutex_lock(&rmi4_data->rmi4_io_ctrl_mutex);



	retval = synaptics_rmi4_i2c_alloc_buf(rmi4_data, length + 1);

	if (retval < 0)

		return retval;



	mutex_lock(&rmi4_data->rmi4_io_ctrl_mutex);

		goto exit;



	retval = synaptics_rmi4_i2c_set_page(rmi4_data, addr);

	if (retval != PAGE_SELECT_LEN) {