evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

input: touchscreen: gt9xx: fix memory corruption in Goodix driver

Browse source 
Fix memory corruption in Goodix touchscreen driver, by resetting
the global structure cmd_head to zero (except *data and wr flag)
in goodix_tool_write handler on error case.

Change-Id: I4f7f8f464b93571627b922b10c10a65826228e42
Signed-off-by: Vevek Venkatesan <vevekv@codeaurora.org>
This commit is contained in:
Vevek Venkatesan 2017-01-23 18:04:53 +05:30
parent 3a7e752617
commit 2881d2bbc2
1 changed files with 7 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
drivers/input/touchscreen/gt9xx/goodix_tool.c
View file

@ -1,7 +1,7 @@
/* drivers/input/touchscreen/goodix_tool.c /* drivers/input/touchscreen/goodix_tool.c
* *
* 2010 - 2012 Goodix Technology. * 2010 - 2012 Goodix Technology.
* Copyright (c) 2013-2016, The Linux Foundation. All rights reserved. * Copyright (c) 2013-2017, The Linux Foundation. All rights reserved.
* *
* This program is free software; you can redistribute it and/or modify * This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by * it under the terms of the GNU General Public License as published by
@ -308,6 +308,7 @@ static ssize_t goodix_tool_write(struct file *filp, const char __user *userbuf,
size_t count, loff_t *ppos) size_t count, loff_t *ppos)
{ {
s32 ret = 0; s32 ret = 0;
u8 *dataptr = NULL;
mutex_lock(&lock); mutex_lock(&lock);
ret = copy_from_user(&cmd_head, userbuf, CMD_HEAD_LENGTH); ret = copy_from_user(&cmd_head, userbuf, CMD_HEAD_LENGTH);
@ -463,6 +464,11 @@ static ssize_t goodix_tool_write(struct file *filp, const char __user *userbuf,
ret = CMD_HEAD_LENGTH; ret = CMD_HEAD_LENGTH;
exit: exit:
dataptr = cmd_head.data;
memset(&cmd_head, 0, sizeof(cmd_head));
cmd_head.wr = 0xFF;
cmd_head.data = dataptr;
mutex_unlock(&lock); mutex_unlock(&lock);
return ret; return ret;
} }