diff options
| author |   Christophe JAILLET <christophe.jaillet@wanadoo.fr> | 2018-04-06 15:36:11 -0700 |
|---|---|---|
| committer |   Dmitry Torokhov <dmitry.torokhov@gmail.com> | 2018-04-06 15:39:18 -0700 |
| commit | 839c42273617787318da7baf6151d553108f5e17 (patch) | |
| tree | cf916a04b3632b742374f3f19c6222d6856848d6 /drivers/input/rmi4/rmi_spi.c | |
| parent | Merge branch 'next' into for-linus (diff) | |
| download | linux-dev-839c42273617787318da7baf6151d553108f5e17.tar.xz linux-dev-839c42273617787318da7baf6151d553108f5e17.zip | |
Input: synaptics-rmi4 - fix an unchecked out of memory error path
When extending the rmi_spi buffers, we must check that no out of memory
error occurs, otherwise we may access data above the currently allocated
memory.
Propagate the error code returned by 'rmi_spi_manage_pools()' instead.
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Reviewed-by: Andrew Duggan <aduggan@synaptics.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Diffstat (limited to 'drivers/input/rmi4/rmi_spi.c')
| -rw-r--r-- | drivers/input/rmi4/rmi_spi.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/drivers/input/rmi4/rmi_spi.c b/drivers/input/rmi4/rmi_spi.c index 76edbf2c1bce..082defc329a8 100644 --- a/drivers/input/rmi4/rmi_spi.c +++ b/drivers/input/rmi4/rmi_spi.c @@ -147,8 +147,11 @@ static int rmi_spi_xfer(struct rmi_spi_xport *rmi_spi, if (len > RMI_SPI_XFER_SIZE_LIMIT) return -EINVAL; - if (rmi_spi->xfer_buf_size < len) - rmi_spi_manage_pools(rmi_spi, len); + if (rmi_spi->xfer_buf_size < len) { + ret = rmi_spi_manage_pools(rmi_spi, len); + if (ret < 0) + return ret; + } if (addr == 0) /* |