Merge "input: synaptics_dsx: allocate heap memory for temp buf" (ae90b14a) · Commits · e / devices / android_kernel_sony_msm8998

drivers/input/touchscreen/synaptics_dsx/synaptics_dsx_rmi_dev.c

+15 −6

Original line number	Diff line number	Diff line
		@@ -347,7 +347,7 @@ static ssize_t rmidev_read(struct file filp, char __user buf,
		size_t count, loff_t *f_pos)
		{
		ssize_t retval;
		unsigned char tmpbuf[count + 1];
		unsigned char *tmpbuf;
		struct rmidev_data *dev_data = filp->private_data;

		if (IS_ERR(dev_data)) {
		@@ -361,6 +361,10 @@ static ssize_t rmidev_read(struct file filp, char __user buf,
		if (count > (REG_ADDR_LIMIT - *f_pos))
		count = REG_ADDR_LIMIT - *f_pos;

		tmpbuf = kzalloc(count + 1, GFP_KERNEL);
		if (!tmpbuf)
		return -ENOMEM;

		mutex_lock(&(dev_data->file_mutex));

		retval = synaptics_rmi4_reg_read(rmidev->rmi4_data,
		@@ -377,7 +381,7 @@ static ssize_t rmidev_read(struct file filp, char __user buf,

		clean_up:
		mutex_unlock(&(dev_data->file_mutex));

		kfree(tmpbuf);
		return retval;
		}

		@@ -393,7 +397,7 @@ static ssize_t rmidev_write(struct file filp, const char __user buf,
		size_t count, loff_t *f_pos)
		{
		ssize_t retval;
		unsigned char tmpbuf[count + 1];
		unsigned char *tmpbuf;
		struct rmidev_data *dev_data = filp->private_data;

		if (IS_ERR(dev_data)) {
		@@ -407,9 +411,14 @@ static ssize_t rmidev_write(struct file filp, const char __user buf,
		if (count > (REG_ADDR_LIMIT - *f_pos))
		count = REG_ADDR_LIMIT - *f_pos;

		if (copy_from_user(tmpbuf, buf, count))
		return -EFAULT;
		tmpbuf = kzalloc(count + 1, GFP_KERNEL);
		if (!tmpbuf)
		return -ENOMEM;

		if (copy_from_user(tmpbuf, buf, count)) {
		kfree(tmpbuf);
		return -EFAULT;
		}
		mutex_lock(&(dev_data->file_mutex));

		retval = synaptics_rmi4_reg_write(rmidev->rmi4_data,
		@@ -420,7 +429,7 @@ static ssize_t rmidev_write(struct file filp, const char __user buf,
		*f_pos += retval;

		mutex_unlock(&(dev_data->file_mutex));

		kfree(tmpbuf);
		return retval;
		}