linux-kernel - [PATCH v3 2/4] input: cyttsp5: improve read size

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20250110-nekocwd-upstreaming-cyttsp5-v3-2-b33659c8effc@gmail.com>
Date: Fri, 10 Jan 2025 00:37:48 +0300
From: Vasiliy Doylov via B4 Relay <devnull+nekodevelopper.gmail.com@...nel.org>
To: Linus Walleij <linus.walleij@...aro.org>, 
 Dmitry Torokhov <dmitry.torokhov@...il.com>
Cc: linux-input@...r.kernel.org, linux-kernel@...r.kernel.org, 
 James Hilliard <james.hilliard1@...il.com>, 
 "Vasiliy Doylov (NekoCWD)" <nekodevelopper@...il.com>
Subject: [PATCH v3 2/4] input: cyttsp5: improve read size

From: "Vasiliy Doylov (NekoCWD)" <nekodevelopper@...il.com>

Before PIP 1.7 empty buffer is 0x0002
>From PIP 1.7, empty buffer is 0xFFXX

Co-developed-by: James Hilliard <james.hilliard1@...il.com>
Signed-off-by: James Hilliard <james.hilliard1@...il.com>
Signed-off-by: Vasiliy Doylov (NekoCWD) <nekodevelopper@...il.com>
---
 drivers/input/touchscreen/cyttsp5.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/drivers/input/touchscreen/cyttsp5.c b/drivers/input/touchscreen/cyttsp5.c
index ef74b4f190351b99c0722b38ae5fa491a4087ffe..4b73b1abc7e449b2dd0c453b816ce7887d9ddb0e 100644
--- a/drivers/input/touchscreen/cyttsp5.c
+++ b/drivers/input/touchscreen/cyttsp5.c
@@ -27,6 +27,7 @@
 #define CY_I2C_DATA_SIZE			(2 * 256)
 #define HID_VERSION				0x0100
 #define CY_MAX_INPUT				512
+#define CY_PIP_1P7_EMPTY_BUF			0xFF00
 #define CYTTSP5_PREALLOCATED_CMD_BUFFER		32
 #define CY_BITS_PER_BTN				1
 #define CY_NUM_BTN_EVENT_ID			GENMASK(CY_BITS_PER_BTN - 1, 0)
@@ -228,7 +229,11 @@ static int cyttsp5_read(struct cyttsp5 *ts, u8 *buf, u32 max)
 		return error;
 
 	size = get_unaligned_le16(temp);
-	if (!size || size == 2)
+	/*
+	 * Before PIP 1.7, empty buffer is 0x0002
+	 * From PIP 1.7, empty buffer is 0xFFXX
+	 */
+	if (!size || size == 2 || size >= CY_PIP_1P7_EMPTY_BUF)
 		return 0;
 
 	if (size > max)
@@ -708,7 +713,8 @@ static irqreturn_t cyttsp5_handle_irq(int irq, void *handle)
 	if (size == 0) {
 		/* reset */
 		report_id = 0;
-		size = 2;
+	} else if (size == 2 || size >= CY_PIP_1P7_EMPTY_BUF) {
+		return IRQ_HANDLED;
 	} else {
 		report_id = ts->input_buf[2];
 	}
@@ -744,7 +750,7 @@ static int cyttsp5_deassert_int(struct cyttsp5 *ts)
 		return error;
 
 	size = get_unaligned_le16(&buf[0]);
-	if (size == 2 || size == 0)
+	if (size == 2 || size == 0 || size >= CY_PIP_1P7_EMPTY_BUF)
 		return 0;
 
 	return -EINVAL;

-- 
2.47.1