diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2021-12-25 13:00:14 -0800 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2021-12-25 13:00:14 -0800 |
| commit | 5b5e3d03470205b98363f50b8d6a7f5f40440458 (patch) | |
| tree | 3787e7bd3fda3f898c7f88b862bfeb3293583e14 /drivers/input/mouse/elantech.c | |
| parent | d0cc67b2781654ac71c73d303e0347e5e9b10ad3 (diff) | |
| parent | 4ebfee2bbc1a9c343dd50565ba5ae249fac32267 (diff) | |
| download | lwn-5b5e3d03470205b98363f50b8d6a7f5f40440458.tar.gz lwn-5b5e3d03470205b98363f50b8d6a7f5f40440458.zip | |
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input
Pull input fixes from Dmitry Torokhov:
"A few small updates to drivers.
Of note we are now deferring probes of i8042 on some Asus devices as
the controller is not ready to respond to queries first time around
when the driver is compiled into the kernel"
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
Input: elants_i2c - do not check Remark ID on eKTH3900/eKTH5312
Input: atmel_mxt_ts - fix double free in mxt_read_info_block
Input: goodix - fix memory leak in goodix_firmware_upload
Input: goodix - add id->model mapping for the "9111" model
Input: goodix - try not to touch the reset-pin on x86/ACPI devices
Input: i8042 - enable deferred probe quirk for ASUS UM325UA
Input: elantech - fix stack out of bound access in elantech_change_report_id()
Input: iqs626a - prohibit inlining of channel parsing functions
Input: i8042 - add deferred probe support
Diffstat (limited to 'drivers/input/mouse/elantech.c')
| -rw-r--r-- | drivers/input/mouse/elantech.c | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c index 956d9cd34796..ece97f8c6a3e 100644 --- a/drivers/input/mouse/elantech.c +++ b/drivers/input/mouse/elantech.c @@ -1588,7 +1588,13 @@ static const struct dmi_system_id no_hw_res_dmi_table[] = { */ static int elantech_change_report_id(struct psmouse *psmouse) { - unsigned char param[2] = { 0x10, 0x03 }; + /* + * NOTE: the code is expecting to receive param[] as an array of 3 + * items (see __ps2_command()), even if in this case only 2 are + * actually needed. Make sure the array size is 3 to avoid potential + * stack out-of-bound accesses. + */ + unsigned char param[3] = { 0x10, 0x03 }; if (elantech_write_reg_params(psmouse, 0x7, param) || elantech_read_reg_params(psmouse, 0x7, param) || |