Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f1286a43 authored by Venkata Prahlad Valluru's avatar Venkata Prahlad Valluru
Browse files

input: synaptics_dsx_2.6: Propagating security fixes from msm-3.18 



This commit is a squash of below security fixes from the
branch msm-3.18.

d95b239 input: synaptics_dsx_2.6: protect tmpbuf allocation
ac27665 input: touchscreen: fix buffer overflow issue in synaptics driver

Change-Id: Id81f89bb07a2b167edff5490882b8db8e96c7072
Signed-off-by: default avatarVenkata Prahlad Valluru <vvalluru@codeaurora.org>
parent c24097ef

drivers/input/touchscreen/synaptics_dsx_2.6/synaptics_dsx_fw_update.c

+3 −1
Original line number Diff line number Diff line
@@ -2219,10 +2219,12 @@ static int fwu_get_image_firmware_id(unsigned int *fw_id) 
					__func__);

			return -ENOMEM;

		}

		while (strptr[index] >= '0' && strptr[index] <= '9') {

		while ((index < MAX_FIRMWARE_ID_LEN - 1) && strptr[index] >= '0'

						&& strptr[index] <= '9') {

			firmware_id[index] = strptr[index];

			index++;

		}

		firmware_id[index] = '\0';



		retval = sstrtoul(firmware_id, 10, (unsigned long *)fw_id);

		kfree(firmware_id);

drivers/input/touchscreen/synaptics_dsx_2.6/synaptics_dsx_rmi_dev.c

+24 −9
Original line number Diff line number Diff line
@@ -563,18 +563,24 @@ static ssize_t rmidev_read(struct file *filp, char __user *buf, 
		return -EBADF;

	}



	if (count == 0)

		return 0;

	mutex_lock(&(dev_data->file_mutex));



	if (*f_pos > REG_ADDR_LIMIT) {

		retval = -EFAULT;

		goto clean_up;

	}



	if (count > (REG_ADDR_LIMIT - *f_pos))

		count = REG_ADDR_LIMIT - *f_pos;



	if (count == 0) {

		retval = 0;

		goto clean_up;

	}

	address = (unsigned short)(*f_pos);



	rmidev_allocate_buffer(count);



	mutex_lock(&(dev_data->file_mutex));



	retval = synaptics_rmi4_reg_read(rmidev->rmi4_data,

			*f_pos,

			rmidev->tmpbuf,
@@ -634,18 +640,26 @@ static ssize_t rmidev_write(struct file *filp, const char __user *buf, 
		return -EBADF;

	}



	if (count == 0)

		return 0;

	mutex_lock(&(dev_data->file_mutex));



	if (*f_pos > REG_ADDR_LIMIT) {

		retval = -EFAULT;

		goto unlock;

	}



	if (count > (REG_ADDR_LIMIT - *f_pos))

		count = REG_ADDR_LIMIT - *f_pos;



	if (count == 0) {

		retval = 0;

		goto unlock;

	}

	rmidev_allocate_buffer(count);



	if (copy_from_user(rmidev->tmpbuf, buf, count))

	if (copy_from_user(rmidev->tmpbuf, buf, count)) {

		return -EFAULT;



	mutex_lock(&(dev_data->file_mutex));

		goto unlock;

	}



	retval = synaptics_rmi4_reg_write(rmidev->rmi4_data,

			*f_pos,
@@ -654,6 +668,7 @@ static ssize_t rmidev_write(struct file *filp, const char __user *buf, 
	if (retval >= 0)

		*f_pos += retval;



unlock:

	mutex_unlock(&(dev_data->file_mutex));



	return retval;