DivestOS/Patches/Linux_CVEs/CVE-2017-0434/0.patch

35 lines
1.4 KiB
Diff

From d740e7228bd1578ed01762998b2a86e7df56e608 Mon Sep 17 00:00:00 2001
From: Andrew Chant <achant@google.com>
Date: Fri, 2 Dec 2016 20:49:26 -0800
Subject: [PATCH] input: synaptics_dsx: reallocate buffer under lock.
Prevent concurrent usage & re-allocation of the wr_buf variable.
Based off patch by chengengjia <chengjia4574@gmail.com>.
BUG: 33001936
Change-Id: I88d78e1ec0fc9e88b1e6824c06161b67d01136ec
Signed-off-by: Andrew Chant <achant@google.com>
---
drivers/input/touchscreen/synaptics_dsx_htc_2.6/synaptics_dsx_i2c.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/input/touchscreen/synaptics_dsx_htc_2.6/synaptics_dsx_i2c.c b/drivers/input/touchscreen/synaptics_dsx_htc_2.6/synaptics_dsx_i2c.c
index 5312f86a93470..3acd4d54bb6d5 100644
--- a/drivers/input/touchscreen/synaptics_dsx_htc_2.6/synaptics_dsx_i2c.c
+++ b/drivers/input/touchscreen/synaptics_dsx_htc_2.6/synaptics_dsx_i2c.c
@@ -557,11 +557,11 @@ static int synaptics_rmi4_i2c_write(struct synaptics_rmi4_data *rmi4_data,
struct i2c_client *i2c = to_i2c_client(rmi4_data->pdev->dev.parent);
struct i2c_msg msg[1];
+ mutex_lock(&rmi4_data->rmi4_io_ctrl_mutex);
+
retval = synaptics_rmi4_i2c_alloc_buf(rmi4_data, length + 1);
if (retval < 0)
- return retval;
-
- mutex_lock(&rmi4_data->rmi4_io_ctrl_mutex);
+ goto exit;
retval = synaptics_rmi4_i2c_set_page(rmi4_data, addr);
if (retval != PAGE_SELECT_LEN) {