From 0ab30d91fb178c5967753343029581983a4e9b67 Mon Sep 17 00:00:00 2001 From: Andrew Chant Date: Fri, 13 Jan 2017 13:33:57 -0800 Subject: [PATCH] input: synaptics_dsx: protect tmpbuf allocation. Protect tmpbuf from concurrent access by mutex. BUG: 33555878 BUG: 33002026 Change-Id: Ia986a34647d5825946594ea17a5cd6fa0abb115f Signed-off-by: Andrew Chant --- .../synaptics_dsx25/synaptics_dsx_rmi_dev.c | 33 +++++++++++++++------- 1 file changed, 23 insertions(+), 10 deletions(-) diff --git a/drivers/input/touchscreen/synaptics_dsx25/synaptics_dsx_rmi_dev.c b/drivers/input/touchscreen/synaptics_dsx25/synaptics_dsx_rmi_dev.c index 87abf86cdc6b4..018c621c0cfeb 100644 --- a/drivers/input/touchscreen/synaptics_dsx25/synaptics_dsx_rmi_dev.c +++ b/drivers/input/touchscreen/synaptics_dsx25/synaptics_dsx_rmi_dev.c @@ -483,16 +483,21 @@ static ssize_t rmidev_read(struct file *filp, char __user *buf, return -EBADF; } - if (count == 0) - return 0; + mutex_lock(&(dev_data->file_mutex)); + if (*f_pos > REG_ADDR_LIMIT) { + retval = -EFAULT; + goto clean_up; + } if (count > (REG_ADDR_LIMIT - *f_pos)) count = REG_ADDR_LIMIT - *f_pos; + if (count == 0) { + retval = 0; + goto clean_up; + } rmidev_allocate_buffer(count); - mutex_lock(&(dev_data->file_mutex)); - retval = synaptics_rmi4_reg_read(rmidev->rmi4_data, *f_pos, rmidev->tmpbuf, @@ -530,18 +535,25 @@ static ssize_t rmidev_write(struct file *filp, const char __user *buf, return -EBADF; } - if (count == 0) - return 0; + mutex_lock(&(dev_data->file_mutex)); + if (*f_pos > REG_ADDR_LIMIT) { + retval = -EFAULT; + goto unlock; + } if (count > (REG_ADDR_LIMIT - *f_pos)) count = REG_ADDR_LIMIT - *f_pos; + if (count == 0) { + retval = 0; + goto unlock; + } rmidev_allocate_buffer(count); - if (copy_from_user(rmidev->tmpbuf, buf, count)) - return -EFAULT; - - mutex_lock(&(dev_data->file_mutex)); + if (copy_from_user(rmidev->tmpbuf, buf, count)) { + retval = -EFAULT; + goto unlock; + } retval = synaptics_rmi4_reg_write(rmidev->rmi4_data, *f_pos, @@ -550,6 +562,7 @@ static ssize_t rmidev_write(struct file *filp, const char __user *buf, if (retval >= 0) *f_pos += retval; +unlock: mutex_unlock(&(dev_data->file_mutex)); return retval;