Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit bf1fb219 authored by Venkata Prahlad Valluru's avatar Venkata Prahlad Valluru
Browse files

input: synaptics_dsx: protect tmpbuf allocation 



Protect tmpbuf from concurrent access by mutex.
BUG: 33555878
BUG: 33002026

Change-Id: Ia7eeb59ca7b626f416e2298b4b9ffd960fe909e4
Signed-off-by: default avatarAndrew Chant <achant@google.com>
Git-repo: https://android.googlesource.com/kernel/msm


Git-commit: e6430a4da1fb0212a546379eadbe986f629c3ae9
Signed-off-by: default avatarVenkata Prahlad Valluru <vvalluru@codeaurora.org>
parent be566880

drivers/input/touchscreen/synaptics_dsx/synaptics_dsx_rmi_dev.c

+24 −9
Original line number Diff line number Diff line
@@ -567,16 +567,22 @@ static ssize_t rmidev_read(struct file *filp, char __user *buf, 
		return -EBADF;

	}



	if (count == 0)

		return 0;

	mutex_lock(&(dev_data->file_mutex));



	if (*f_pos > REG_ADDR_LIMIT) {

		retval = -EFAULT;

		goto clean_up;

	}



	if (count > (REG_ADDR_LIMIT - *f_pos))

		count = REG_ADDR_LIMIT - *f_pos;



	if (count == 0) {

		retval = 0;

		goto clean_up;

	}

	address = (unsigned short)(*f_pos);



	mutex_lock(&(dev_data->file_mutex));



	rmidev_allocate_buffer(count);



	retval = synaptics_rmi4_reg_read(rmidev->rmi4_data,
@@ -638,18 +644,26 @@ static ssize_t rmidev_write(struct file *filp, const char __user *buf, 
		return -EBADF;

	}



	if (count == 0)

		return 0;

	mutex_lock(&(dev_data->file_mutex));



	if (*f_pos > REG_ADDR_LIMIT) {

		retval = -EFAULT;

		goto unlock;

	}



	if (count > (REG_ADDR_LIMIT - *f_pos))

		count = REG_ADDR_LIMIT - *f_pos;



	mutex_lock(&(dev_data->file_mutex));



	if (count == 0) {

		retval = 0;

		goto unlock;

	}

	rmidev_allocate_buffer(count);



	if (copy_from_user(rmidev->tmpbuf, buf, count))

	if (copy_from_user(rmidev->tmpbuf, buf, count)) {

		return -EFAULT;

		goto unlock;

	}



	retval = synaptics_rmi4_reg_write(rmidev->rmi4_data,

			*f_pos,
@@ -658,6 +672,7 @@ static ssize_t rmidev_write(struct file *filp, const char __user *buf, 
	if (retval >= 0)

		*f_pos += retval;



unlock:

	mutex_unlock(&(dev_data->file_mutex));



	return retval;