| From d2983cdb480157f637df07723f28aaa657b1080d Mon Sep 17 00:00:00 2001 |
| From: Ferruh Yigit <fery@cypress.com> |
| Date: Thu, 23 May 2013 09:56:55 -0700 |
| Subject: Input: cyttsp - fix memcpy size param |
| |
| From: Ferruh Yigit <fery@cypress.com> |
| |
| commit d2983cdb480157f637df07723f28aaa657b1080d upstream. |
| |
| memcpy param is wrong because of offset in bl_cmd, this may corrupt the |
| stack which may cause a crash. |
| |
| Tested-by: Ferruh Yigit <fery@cypress.com> on TMA300-DVK |
| Signed-off-by: Ferruh Yigit <fery@cypress.com> |
| Acked-by: Javier Martinez Canillas <javier@dowhile0.org> |
| Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| drivers/input/touchscreen/cyttsp_core.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| --- a/drivers/input/touchscreen/cyttsp_core.c |
| +++ b/drivers/input/touchscreen/cyttsp_core.c |
| @@ -133,7 +133,7 @@ static int cyttsp_exit_bl_mode(struct cy |
| memcpy(bl_cmd, bl_command, sizeof(bl_command)); |
| if (ts->pdata->bl_keys) |
| memcpy(&bl_cmd[sizeof(bl_command) - CY_NUM_BL_KEYS], |
| - ts->pdata->bl_keys, sizeof(bl_command)); |
| + ts->pdata->bl_keys, CY_NUM_BL_KEYS); |
| |
| error = ttsp_write_block_data(ts, CY_REG_BASE, |
| sizeof(bl_cmd), bl_cmd); |
