evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge "input: synaptics: fix for buggy code poined by SIL tool"

Browse source
This commit is contained in:
Linux Build Service Account 2017-05-02 09:07:38 -07:00 • committed by Gerrit - the friendly Code Review server
commit 9edaf67e54
1 changed files with 36 additions and 16 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

52
drivers/input/touchscreen/synaptics_dsx/synaptics_dsx_rmi_dev.c
View file

@ -355,18 +355,25 @@ static ssize_t rmidev_read(struct file *filp, char __user *buf,
return -EBADF; return -EBADF;
} }
if (count == 0) mutex_lock(&(dev_data->file_mutex));
return 0;
if (count > (REG_ADDR_LIMIT - *f_pos)) if (count > (REG_ADDR_LIMIT - *f_pos))
count = REG_ADDR_LIMIT - *f_pos; count = REG_ADDR_LIMIT - *f_pos;
if (count == 0) {
retval = 0;
goto unlock;
}
if (*f_pos > REG_ADDR_LIMIT) {
retval = -EFAULT;
goto unlock;
}
tmpbuf = kzalloc(count + 1, GFP_KERNEL); tmpbuf = kzalloc(count + 1, GFP_KERNEL);
if (!tmpbuf) if (!tmpbuf) {
return -ENOMEM; retval = -ENOMEM;
goto unlock;
mutex_lock(&(dev_data->file_mutex)); }
retval = synaptics_rmi4_reg_read(rmidev->rmi4_data, retval = synaptics_rmi4_reg_read(rmidev->rmi4_data,
*f_pos, *f_pos,
tmpbuf, tmpbuf,
@ -380,8 +387,9 @@ static ssize_t rmidev_read(struct file *filp, char __user *buf,
*f_pos += retval; *f_pos += retval;
clean_up: clean_up:
mutex_unlock(&(dev_data->file_mutex));
kfree(tmpbuf); kfree(tmpbuf);
unlock:
mutex_unlock(&(dev_data->file_mutex));
return retval; return retval;
} }
@ -405,21 +413,31 @@ static ssize_t rmidev_write(struct file *filp, const char __user *buf,
return -EBADF; return -EBADF;
} }
if (count == 0) mutex_lock(&(dev_data->file_mutex));
return 0;
if (*f_pos > REG_ADDR_LIMIT) {
retval = -EFAULT;
goto unlock;
}
if (count > (REG_ADDR_LIMIT - *f_pos)) if (count > (REG_ADDR_LIMIT - *f_pos))
count = REG_ADDR_LIMIT - *f_pos; count = REG_ADDR_LIMIT - *f_pos;
if (count == 0) {
retval = 0;
goto unlock;
}
tmpbuf = kzalloc(count + 1, GFP_KERNEL); tmpbuf = kzalloc(count + 1, GFP_KERNEL);
if (!tmpbuf) if (!tmpbuf) {
return -ENOMEM; retval = -ENOMEM;
goto unlock;
}
if (copy_from_user(tmpbuf, buf, count)) { if (copy_from_user(tmpbuf, buf, count)) {
kfree(tmpbuf); retval = -EFAULT;
return -EFAULT; goto clean_up;
} }
mutex_lock(&(dev_data->file_mutex));
retval = synaptics_rmi4_reg_write(rmidev->rmi4_data, retval = synaptics_rmi4_reg_write(rmidev->rmi4_data,
*f_pos, *f_pos,
@ -428,8 +446,10 @@ static ssize_t rmidev_write(struct file *filp, const char __user *buf,
if (retval >= 0) if (retval >= 0)
*f_pos += retval; *f_pos += retval;
mutex_unlock(&(dev_data->file_mutex)); clean_up:
kfree(tmpbuf); kfree(tmpbuf);
unlock:
mutex_unlock(&(dev_data->file_mutex));
return retval; return retval;
} }