linux-kernel - [PATCH] Input: atmel_mxt_ts - fix a few issues reported by Coverity

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20140811180307.GA25677@core.coreip.homeip.net>
Date:	Mon, 11 Aug 2014 11:03:09 -0700
From:	Dmitry Torokhov <dmitry.torokhov@...il.com>
To:	linux-input@...r.kernel.org
Cc:	Nick Dyer <nick.dyer@...ev.co.uk>,
	Yufeng Shen <miletus@...omium.org>,
	Benson Leung <bleung@...omium.org>,
	Stephen Warren <swarren@...dia.com>,
	linux-kernel@...r.kernel.org
Subject: [PATCH] Input: atmel_mxt_ts - fix a few issues reported by Coverity

This should fix the following issues reported by Coverity:

*** CID 1230625:  Logically dead code  (DEADCODE)
/drivers/input/touchscreen/atmel_mxt_ts.c: 1692 in mxt_initialize()

*** CID 1230627:  Missing break in switch  (MISSING_BREAK)
/drivers/input/touchscreen/atmel_mxt_ts.c: 1436 in mxt_get_object_table()

*** CID 1230629:  Out-of-bounds write  (OVERRUN)
/drivers/input/touchscreen/atmel_mxt_ts.c: 1267 in mxt_update_cfg()

*** CID 1230632:  Unused pointer value  (UNUSED_VALUE)
/drivers/input/touchscreen/atmel_mxt_ts.c: 1211 in mxt_update_cfg()

Signed-off-by: Dmitry Torokhov <dmitry.torokhov@...il.com>
---
 drivers/input/touchscreen/atmel_mxt_ts.c | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c b/drivers/input/touchscreen/atmel_mxt_ts.c
index bbaf3ff..db178ed 100644
--- a/drivers/input/touchscreen/atmel_mxt_ts.c
+++ b/drivers/input/touchscreen/atmel_mxt_ts.c
@@ -1098,8 +1098,12 @@ static int mxt_prepare_cfg_mem(struct mxt_data *data,
 			/* Skip object */
 			for (i = 0; i < size; i++) {
 				ret = sscanf(cfg->data + data_pos, "%hhx%n",
-					     &val,
-					     &offset);
+					     &val, &offset);
+				if (ret != 1) {
+					dev_err(dev, "Bad format in T%d at %d\n",
+						type, i);
+					return -EINVAL;
+				}
 				data_pos += offset;
 			}
 			continue;
@@ -1139,7 +1143,8 @@ static int mxt_prepare_cfg_mem(struct mxt_data *data,
 				     &val,
 				     &offset);
 			if (ret != 1) {
-				dev_err(dev, "Bad format in T%d\n", type);
+				dev_err(dev, "Bad format in T%d at %d\n",
+					type, i);
 				return -EINVAL;
 			}
 			data_pos += offset;
@@ -1149,8 +1154,7 @@ static int mxt_prepare_cfg_mem(struct mxt_data *data,
 
 			byte_offset = reg + i - cfg_start_ofs;
 
-			if (byte_offset >= 0 &&
-			    byte_offset <= config_mem_size) {
+			if (byte_offset >= 0 && byte_offset < config_mem_size) {
 				*(config_mem + byte_offset) = val;
 			} else {
 				dev_err(dev, "Bad object: reg:%d, T%d, ofs=%d\n",
@@ -1454,6 +1458,7 @@ static int mxt_get_object_table(struct mxt_data *data)
 				data->T5_msg_size = mxt_obj_size(object) - 1;
 			}
 			data->T5_address = object->start_address;
+			break;
 		case MXT_GEN_COMMAND_T6:
 			data->T6_reportid = min_id;
 			data->T6_address = object->start_address;
@@ -1707,7 +1712,7 @@ static int mxt_initialize(struct mxt_data *data)
 		return error;
 	}
 
-	mxt_acquire_irq(data);
+	error = mxt_acquire_irq(data);
 	if (error)
 		goto err_free_object_table;
 
-- 
2.0.0.526.g5318336


-- 
Dmitry
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/