mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-06-02 05:13:11 -04:00
Code Issues Packages Projects Releases Wiki Activity

Input: atmel_mxt_ts - check mem_size before calculating config memory size

Browse Source 
In mxt_update_cfg(), the driver calculates the memory size needed to store
the configuration as data->mem_size - cfg.start_ofs. If data->mem_size is
less than or equal to cfg.start_ofs, this calculation will underflow or
result in a zero-size buffer, neither of which is valid for a configuration
update.

Add a check to return -EINVAL if data->mem_size is too small. While at it,
change the types of start_ofs and mem_size in struct mxt_cfg to u16 to
match the device address space.

Assisted-by: Gemini:gemini-3.1-pro
Link: https://patch.msgid.link/20260504185448.4055973-2-dmitry.torokhov@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
This commit is contained in:
Dmitry Torokhov
2026-05-04 11:54:46 -07:00
parent baa0210fb6
commit a5fd88a5d6
1 changed files with 9 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
drivers/input/touchscreen/atmel_mxt_ts.c
View File

@@ -275,8 +275,8 @@ struct mxt_cfg {
off_t raw_pos;
u8 *mem;
size_t mem_size;
int start_ofs;
u16 mem_size;
u16 start_ofs;
struct mxt_info info;
};
@@ -1627,6 +1627,13 @@ static int mxt_update_cfg(struct mxt_data *data, const struct firmware *fw)
cfg.start_ofs = MXT_OBJECT_START +
data->info->object_num * sizeof(struct mxt_object) +
MXT_INFO_CHECKSUM_SIZE;
if (data->mem_size <= cfg.start_ofs) {
dev_err(dev, "Memory size too small: %u < %u\n",
data->mem_size, cfg.start_ofs);
return -EINVAL;
}
cfg.mem_size = data->mem_size - cfg.start_ofs;
u8 *mem_buf __free(kfree) = cfg.mem = kzalloc(cfg.mem_size, GFP_KERNEL);