Merge "input: synaptics_dsx_2.6: Propagating security fixes from msm-3.18" (cf951a4d) · Commits · e / devices / android_kernel_fairphone_FP3

drivers/input/touchscreen/synaptics_dsx_2.6/synaptics_dsx_fw_update.c

+3 −1

Original line number	Diff line number	Diff line
		@@ -2225,10 +2225,12 @@ static int fwu_get_image_firmware_id(unsigned int *fw_id)
		__func__);
		return -ENOMEM;
		}
		while (strptr[index] >= '0' && strptr[index] <= '9') {
		while ((index < MAX_FIRMWARE_ID_LEN - 1) && strptr[index] >= '0'
		&& strptr[index] <= '9') {
		firmware_id[index] = strptr[index];
		index++;
		}
		firmware_id[index] = '\0';

		retval = sstrtoul(firmware_id, 10, (unsigned long *)fw_id);
		kfree(firmware_id);

+24 −9

Original line number	Diff line number	Diff line
		@@ -563,18 +563,24 @@ static ssize_t rmidev_read(struct file filp, char __user buf,
		return -EBADF;
		}

		if (count == 0)
		return 0;
		mutex_lock(&(dev_data->file_mutex));

		if (*f_pos > REG_ADDR_LIMIT) {
		retval = -EFAULT;
		goto clean_up;
		}

		if (count > (REG_ADDR_LIMIT - *f_pos))
		count = REG_ADDR_LIMIT - *f_pos;

		if (count == 0) {
		retval = 0;
		goto clean_up;
		}
		address = (unsigned short)(*f_pos);

		rmidev_allocate_buffer(count);

		mutex_lock(&(dev_data->file_mutex));

		retval = synaptics_rmi4_reg_read(rmidev->rmi4_data,
		*f_pos,
		rmidev->tmpbuf,
		@@ -634,18 +640,26 @@ static ssize_t rmidev_write(struct file filp, const char __user buf,
		return -EBADF;
		}

		if (count == 0)
		return 0;
		mutex_lock(&(dev_data->file_mutex));

		if (*f_pos > REG_ADDR_LIMIT) {
		retval = -EFAULT;
		goto unlock;
		}

		if (count > (REG_ADDR_LIMIT - *f_pos))
		count = REG_ADDR_LIMIT - *f_pos;

		if (count == 0) {
		retval = 0;
		goto unlock;
		}
		rmidev_allocate_buffer(count);

		if (copy_from_user(rmidev->tmpbuf, buf, count))
		if (copy_from_user(rmidev->tmpbuf, buf, count)) {
		return -EFAULT;

		mutex_lock(&(dev_data->file_mutex));
		goto unlock;
		}

		retval = synaptics_rmi4_reg_write(rmidev->rmi4_data,
		*f_pos,
		@@ -654,6 +668,7 @@ static ssize_t rmidev_write(struct file filp, const char __user buf,
		if (retval >= 0)
		*f_pos += retval;

		unlock:
		mutex_unlock(&(dev_data->file_mutex));

		return retval;