diff options
| author | Jonathan Cameron <jic23@kernel.org> | 2026-06-02 15:24:19 +0100 |
|---|---|---|
| committer | Jonathan Cameron <jic23@kernel.org> | 2026-06-02 15:24:19 +0100 |
| commit | c82228f76aaa3f77eca3ac22670aa69dd0e59d40 (patch) | |
| tree | d04d0936d748104c004a69fe35fc63e0bd3cdfdd /drivers/input/touchscreen/atmel_mxt_ts.c | |
| parent | 3f2d03ecf22b09da1d92ba06e1ba6e20d16060e9 (diff) | |
| parent | e43ffb69e0438cddd72aaa30898b4dc446f664f8 (diff) | |
| download | linux-next-c82228f76aaa3f77eca3ac22670aa69dd0e59d40.tar.gz linux-next-c82228f76aaa3f77eca3ac22670aa69dd0e59d40.zip | |
Merge tag 'v7.1-rc6' into work
Linux 7.1-rc6
Diffstat (limited to 'drivers/input/touchscreen/atmel_mxt_ts.c')
| -rw-r--r-- | drivers/input/touchscreen/atmel_mxt_ts.c | 13 |
1 files changed, 10 insertions, 3 deletions
diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c b/drivers/input/touchscreen/atmel_mxt_ts.c index 87c6a10381f2..f21bf2844112 100644 --- a/drivers/input/touchscreen/atmel_mxt_ts.c +++ b/drivers/input/touchscreen/atmel_mxt_ts.c @@ -275,8 +275,8 @@ struct mxt_cfg { off_t raw_pos; u8 *mem; - size_t mem_size; - int start_ofs; + u16 mem_size; + u16 start_ofs; struct mxt_info info; }; @@ -1473,7 +1473,7 @@ static int mxt_prepare_cfg_mem(struct mxt_data *data, struct mxt_cfg *cfg) } cfg->raw_pos += offset; - if (i > mxt_obj_size(object)) + if (i >= mxt_obj_size(object)) continue; byte_offset = reg + i - cfg->start_ofs; @@ -1627,6 +1627,13 @@ static int mxt_update_cfg(struct mxt_data *data, const struct firmware *fw) cfg.start_ofs = MXT_OBJECT_START + data->info->object_num * sizeof(struct mxt_object) + MXT_INFO_CHECKSUM_SIZE; + + if (data->mem_size <= cfg.start_ofs) { + dev_err(dev, "Memory size too small: %u < %u\n", + data->mem_size, cfg.start_ofs); + return -EINVAL; + } + cfg.mem_size = data->mem_size - cfg.start_ofs; u8 *mem_buf __free(kfree) = cfg.mem = kzalloc(cfg.mem_size, GFP_KERNEL); |