Merge "input: synaptics_dsx: protect tmpbuf allocation" (fe82fb3a) · Commits · e / devices / android_kernel_fairphone_FP3

drivers/input/touchscreen/synaptics_dsx/synaptics_dsx_rmi_dev.c

+24 −9

Original line number	Diff line number	Diff line
		@@ -567,16 +567,22 @@ static ssize_t rmidev_read(struct file filp, char __user buf,
		return -EBADF;
		}

		if (count == 0)
		return 0;
		mutex_lock(&(dev_data->file_mutex));

		if (*f_pos > REG_ADDR_LIMIT) {
		retval = -EFAULT;
		goto clean_up;
		}

		if (count > (REG_ADDR_LIMIT - *f_pos))
		count = REG_ADDR_LIMIT - *f_pos;

		if (count == 0) {
		retval = 0;
		goto clean_up;
		}
		address = (unsigned short)(*f_pos);

		mutex_lock(&(dev_data->file_mutex));

		rmidev_allocate_buffer(count);

		retval = synaptics_rmi4_reg_read(rmidev->rmi4_data,
		@@ -638,18 +644,26 @@ static ssize_t rmidev_write(struct file filp, const char __user buf,
		return -EBADF;
		}

		if (count == 0)
		return 0;
		mutex_lock(&(dev_data->file_mutex));

		if (*f_pos > REG_ADDR_LIMIT) {
		retval = -EFAULT;
		goto unlock;
		}

		if (count > (REG_ADDR_LIMIT - *f_pos))
		count = REG_ADDR_LIMIT - *f_pos;

		mutex_lock(&(dev_data->file_mutex));

		if (count == 0) {
		retval = 0;
		goto unlock;
		}
		rmidev_allocate_buffer(count);

		if (copy_from_user(rmidev->tmpbuf, buf, count))
		if (copy_from_user(rmidev->tmpbuf, buf, count)) {
		return -EFAULT;
		goto unlock;
		}

		retval = synaptics_rmi4_reg_write(rmidev->rmi4_data,
		*f_pos,
		@@ -658,6 +672,7 @@ static ssize_t rmidev_write(struct file filp, const char __user buf,
		if (retval >= 0)
		*f_pos += retval;

		unlock:
		mutex_unlock(&(dev_data->file_mutex));

		return retval;