evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge "input: synaptics: fix for buggy code poined by SIL tool"

Browse source
This commit is contained in:
Linux Build Service Account 2017-05-02 09:07:38 -07:00 • committed by Gerrit - the friendly Code Review server
commit 9edaf67e54
1 changed files with 36 additions and 16 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

52
drivers/input/touchscreen/synaptics_dsx/synaptics_dsx_rmi_dev.c
View file

@ -355,18 +355,25 @@ static ssize_t rmidev_read(struct file *filp, char __user *buf,
return -EBADF;
}
if (count == 0)
return 0;
mutex_lock(&(dev_data->file_mutex));
if (count > (REG_ADDR_LIMIT - *f_pos))
count = REG_ADDR_LIMIT - *f_pos;
if (count == 0) {
retval = 0;
goto unlock;
}
if (*f_pos > REG_ADDR_LIMIT) {
retval = -EFAULT;
goto unlock;
}
tmpbuf = kzalloc(count + 1, GFP_KERNEL);
if (!tmpbuf)
return -ENOMEM;
mutex_lock(&(dev_data->file_mutex));
if (!tmpbuf) {
retval = -ENOMEM;
goto unlock;
}
retval = synaptics_rmi4_reg_read(rmidev->rmi4_data,
*f_pos,
tmpbuf,
@ -380,8 +387,9 @@ static ssize_t rmidev_read(struct file *filp, char __user *buf,
*f_pos += retval;
clean_up:
mutex_unlock(&(dev_data->file_mutex));
kfree(tmpbuf);
unlock:
mutex_unlock(&(dev_data->file_mutex));
return retval;
}
@ -405,21 +413,31 @@ static ssize_t rmidev_write(struct file *filp, const char __user *buf,
return -EBADF;
}
if (count == 0)
return 0;
mutex_lock(&(dev_data->file_mutex));
if (*f_pos > REG_ADDR_LIMIT) {
retval = -EFAULT;
goto unlock;
}
if (count > (REG_ADDR_LIMIT - *f_pos))
count = REG_ADDR_LIMIT - *f_pos;
if (count == 0) {
retval = 0;
goto unlock;
}
tmpbuf = kzalloc(count + 1, GFP_KERNEL);
if (!tmpbuf)
return -ENOMEM;
if (!tmpbuf) {
retval = -ENOMEM;
goto unlock;
}
if (copy_from_user(tmpbuf, buf, count)) {
kfree(tmpbuf);
return -EFAULT;
retval = -EFAULT;
goto clean_up;
}
mutex_lock(&(dev_data->file_mutex));
retval = synaptics_rmi4_reg_write(rmidev->rmi4_data,
*f_pos,
@ -428,8 +446,10 @@ static ssize_t rmidev_write(struct file *filp, const char __user *buf,
if (retval >= 0)
*f_pos += retval;
mutex_unlock(&(dev_data->file_mutex));
clean_up:
kfree(tmpbuf);
unlock:
mutex_unlock(&(dev_data->file_mutex));
return retval;
}