Input: synaptics-rmi4 - do not consume more data than we have (F11, F12)

BugLink: https://bugs.launchpad.net/bugs/1853475
commit 5d40d95e7e64756cc30606c2ba169271704d47cb upstream.

Currently, rmi_f11_attention() and rmi_f12_attention() functions update
the attn_data data pointer and size based on the size of the expected
size of the attention data. However, if the actual valid data in the
attn buffer is less then the expected value then the updated data
pointer will point to memory beyond the end of the attn buffer. Using
the calculated valid_bytes instead will prevent this from happening.

Signed-off-by: Andrew Duggan <aduggan@synaptics.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20191025002527.3189-3-aduggan@synaptics.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Connor Kuehl <connor.kuehl@canonical.com>
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>

diff --git a/drivers/input/rmi4/rmi_f11.c b/drivers/input/rmi4/rmi_f11.c
index f28a7158b2efc572d88dc941481e8b41d62ef825..26c239325f95c406a22e48263c71934b4682d71c 100644 (file)
--- a/drivers/input/rmi4/rmi_f11.c
+++ b/drivers/input/rmi4/rmi_f11.c
@@ -1284,8 +1284,8 @@ static irqreturn_t rmi_f11_attention(int irq, void *ctx)
                        valid_bytes = f11->sensor.attn_size;
                memcpy(f11->sensor.data_pkt, drvdata->attn_data.data,
                        valid_bytes);
-               drvdata->attn_data.data += f11->sensor.attn_size;
-               drvdata->attn_data.size -= f11->sensor.attn_size;
+               drvdata->attn_data.data += valid_bytes;
+               drvdata->attn_data.size -= valid_bytes;
        } else {
                error = rmi_read_block(rmi_dev,
                                data_base_addr, f11->sensor.data_pkt,

diff --git a/drivers/input/rmi4/rmi_f12.c b/drivers/input/rmi4/rmi_f12.c
index 734077f2c40b7ef8ba75b2b1f74e4110383d86c6..7e97944f76165339e4302c2e4c7875d27d8b4550 100644 (file)
--- a/drivers/input/rmi4/rmi_f12.c
+++ b/drivers/input/rmi4/rmi_f12.c
@@ -212,8 +212,8 @@ static irqreturn_t rmi_f12_attention(int irq, void *ctx)
                        valid_bytes = sensor->attn_size;
                memcpy(sensor->data_pkt, drvdata->attn_data.data,
                        valid_bytes);
-               drvdata->attn_data.data += sensor->attn_size;
-               drvdata->attn_data.size -= sensor->attn_size;
+               drvdata->attn_data.data += valid_bytes;
+               drvdata->attn_data.size -= valid_bytes;
        } else {
                retval = rmi_read_block(rmi_dev, f12->data_addr,
                                        sensor->data_pkt, sensor->pkt_size);