Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754776AbbG0VG0 (ORCPT ); Mon, 27 Jul 2015 17:06:26 -0400 Received: from mail-pd0-f180.google.com ([209.85.192.180]:34253 "EHLO mail-pd0-f180.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754405AbbG0VGY (ORCPT ); Mon, 27 Jul 2015 17:06:24 -0400 Date: Mon, 27 Jul 2015 14:06:19 -0700 From: Dmitry Torokhov To: linux-input@vger.kernel.org Cc: Dirk Behme , Heiko Stuebner , Oleksij Rempel , linux-kernel@vger.kernel.org Subject: [PATCH] Input: zforce_ts - fix playload length check Message-ID: <20150727210619.GA2825@dtor-ws> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1799 Lines: 46 Commit 7d01cd261c76f95913c81554a751968a1d282d3a ("Input: zforce - don't overwrite the stack") attempted to add a check for payload size being too large for the supplied buffer. Unfortunately with the currently selected buffer size the comparison is always false as buffer size is larger than the value a single byte can hold, and that results in compiler warnings. Additionally the check was incorrect as it was not accounting for the already read 2 bytes of data stored in the buffer. Fixes: 7d01cd261c76f95913c81554a751968a1d282d3a Reported-by: kbuild test robot Signed-off-by: Dmitry Torokhov --- This seems to shut up my GCC, I wonder if it is going to work gfor everyone or we better add BUILD_BUG_ON(FRAME_MAXSIZE < 257) and a comment and remove check. drivers/input/touchscreen/zforce_ts.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/input/touchscreen/zforce_ts.c b/drivers/input/touchscreen/zforce_ts.c index 2554efd..542ff02 100644 --- a/drivers/input/touchscreen/zforce_ts.c +++ b/drivers/input/touchscreen/zforce_ts.c @@ -441,7 +441,9 @@ static int zforce_read_packet(struct zforce_ts *ts, u8 *buf) goto unlock; } - if (buf[PAYLOAD_LENGTH] == 0 || buf[PAYLOAD_LENGTH] > FRAME_MAXSIZE) { + if (buf[PAYLOAD_LENGTH] == 0 || + (FRAME_MAXSIZE - 2 < 255 && + buf[PAYLOAD_LENGTH] > FRAME_MAXSIZE - 2)) { dev_err(&client->dev, "invalid payload length: %d\n", buf[PAYLOAD_LENGTH]); ret = -EIO; -- 2.5.0.rc2.392.g76e840b -- Dmitry -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/