Input: elan_i2c_smbus - fix more potential stack buffer overflows
authorBen Hutchings <ben.hutchings@codethink.co.uk>
Tue, 19 Jun 2018 18:17:32 +0000 (11:17 -0700)
committerDmitry Torokhov <dmitry.torokhov@gmail.com>
Fri, 22 Jun 2018 00:20:41 +0000 (17:20 -0700)
commit50fc7b61959af4b95fafce7fe5dd565199e0b61a
treefe2962d4ef55cc1b49a52abbb8b913fff2ec1eb4
parent8938fc7b8fe9ccfa11751ead502a8d385b607967
Input: elan_i2c_smbus - fix more potential stack buffer overflows

Commit 40f7090bb1b4 ("Input: elan_i2c_smbus - fix corrupted stack")
fixed most of the functions using i2c_smbus_read_block_data() to
allocate a buffer with the maximum block size.  However three
functions were left unchanged:

* In elan_smbus_initialize(), increase the buffer size in the same
  way.
* In elan_smbus_calibrate_result(), the buffer is provided by the
  caller (calibrate_store()), so introduce a bounce buffer.  Also
  name the result buffer size.
* In elan_smbus_get_report(), the buffer is provided by the caller
  but happens to be the right length.  Add a compile-time assertion
  to ensure this remains the case.

Cc: <stable@vger.kernel.org> # 3.19+
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
drivers/input/mouse/elan_i2c.h
drivers/input/mouse/elan_i2c_core.c
drivers/input/mouse/elan_i2c_smbus.c