mirror of
https://github.com/Divested-Mobile/DivestOS-Build.git
synced 2024-09-06 01:22:20 +00:00
86 lines
2.3 KiB
Diff
86 lines
2.3 KiB
Diff
From 0ab30d91fb178c5967753343029581983a4e9b67 Mon Sep 17 00:00:00 2001
|
|
From: Andrew Chant <achant@google.com>
|
|
Date: Fri, 13 Jan 2017 13:33:57 -0800
|
|
Subject: [PATCH] input: synaptics_dsx: protect tmpbuf allocation.
|
|
|
|
Protect tmpbuf from concurrent access by mutex.
|
|
|
|
BUG: 33555878
|
|
BUG: 33002026
|
|
Change-Id: Ia986a34647d5825946594ea17a5cd6fa0abb115f
|
|
Signed-off-by: Andrew Chant <achant@google.com>
|
|
---
|
|
.../synaptics_dsx25/synaptics_dsx_rmi_dev.c | 33 +++++++++++++++-------
|
|
1 file changed, 23 insertions(+), 10 deletions(-)
|
|
|
|
diff --git a/drivers/input/touchscreen/synaptics_dsx25/synaptics_dsx_rmi_dev.c b/drivers/input/touchscreen/synaptics_dsx25/synaptics_dsx_rmi_dev.c
|
|
index 87abf86cdc6b4..018c621c0cfeb 100644
|
|
--- a/drivers/input/touchscreen/synaptics_dsx25/synaptics_dsx_rmi_dev.c
|
|
+++ b/drivers/input/touchscreen/synaptics_dsx25/synaptics_dsx_rmi_dev.c
|
|
@@ -483,16 +483,21 @@ static ssize_t rmidev_read(struct file *filp, char __user *buf,
|
|
return -EBADF;
|
|
}
|
|
|
|
- if (count == 0)
|
|
- return 0;
|
|
+ mutex_lock(&(dev_data->file_mutex));
|
|
|
|
+ if (*f_pos > REG_ADDR_LIMIT) {
|
|
+ retval = -EFAULT;
|
|
+ goto clean_up;
|
|
+ }
|
|
if (count > (REG_ADDR_LIMIT - *f_pos))
|
|
count = REG_ADDR_LIMIT - *f_pos;
|
|
+ if (count == 0) {
|
|
+ retval = 0;
|
|
+ goto clean_up;
|
|
+ }
|
|
|
|
rmidev_allocate_buffer(count);
|
|
|
|
- mutex_lock(&(dev_data->file_mutex));
|
|
-
|
|
retval = synaptics_rmi4_reg_read(rmidev->rmi4_data,
|
|
*f_pos,
|
|
rmidev->tmpbuf,
|
|
@@ -530,18 +535,25 @@ static ssize_t rmidev_write(struct file *filp, const char __user *buf,
|
|
return -EBADF;
|
|
}
|
|
|
|
- if (count == 0)
|
|
- return 0;
|
|
+ mutex_lock(&(dev_data->file_mutex));
|
|
|
|
+ if (*f_pos > REG_ADDR_LIMIT) {
|
|
+ retval = -EFAULT;
|
|
+ goto unlock;
|
|
+ }
|
|
if (count > (REG_ADDR_LIMIT - *f_pos))
|
|
count = REG_ADDR_LIMIT - *f_pos;
|
|
+ if (count == 0) {
|
|
+ retval = 0;
|
|
+ goto unlock;
|
|
+ }
|
|
|
|
rmidev_allocate_buffer(count);
|
|
|
|
- if (copy_from_user(rmidev->tmpbuf, buf, count))
|
|
- return -EFAULT;
|
|
-
|
|
- mutex_lock(&(dev_data->file_mutex));
|
|
+ if (copy_from_user(rmidev->tmpbuf, buf, count)) {
|
|
+ retval = -EFAULT;
|
|
+ goto unlock;
|
|
+ }
|
|
|
|
retval = synaptics_rmi4_reg_write(rmidev->rmi4_data,
|
|
*f_pos,
|
|
@@ -550,6 +562,7 @@ static ssize_t rmidev_write(struct file *filp, const char __user *buf,
|
|
if (retval >= 0)
|
|
*f_pos += retval;
|
|
|
|
+unlock:
|
|
mutex_unlock(&(dev_data->file_mutex));
|
|
|
|
return retval;
|