releases/3.4.51/input-cyttsp-fix-memcpy-size-param.patch

   1 From d2983cdb480157f637df07723f28aaa657b1080d Mon Sep 17 00:00:00 2001
   2 From: Ferruh Yigit <fery@cypress.com>
   3 Date: Thu, 23 May 2013 09:56:55 -0700
   4 Subject: Input: cyttsp - fix memcpy size param
   5
   6 From: Ferruh Yigit <fery@cypress.com>
   7
   8 commit d2983cdb480157f637df07723f28aaa657b1080d upstream.
   9
  10 memcpy param is wrong because of offset in bl_cmd, this may corrupt the
  11 stack which may cause a crash.
  12
  13 Tested-by: Ferruh Yigit <fery@cypress.com> on TMA300-DVK
  14 Signed-off-by: Ferruh Yigit <fery@cypress.com>
  15 Acked-by: Javier Martinez Canillas <javier@dowhile0.org>
  16 Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
  17 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  18
  19 ---
  20  drivers/input/touchscreen/cyttsp_core.c |    2 +-
  21  1 file changed, 1 insertion(+), 1 deletion(-)
  22
  23 --- a/drivers/input/touchscreen/cyttsp_core.c
  24 +++ b/drivers/input/touchscreen/cyttsp_core.c
  25 @@ -133,7 +133,7 @@ static int cyttsp_exit_bl_mode(struct cy
  26         memcpy(bl_cmd, bl_command, sizeof(bl_command));
  27         if (ts->pdata->bl_keys)
  28                 memcpy(&bl_cmd[sizeof(bl_command) - CY_NUM_BL_KEYS],
  29 -                       ts->pdata->bl_keys, sizeof(bl_command));
  30 +                       ts->pdata->bl_keys, CY_NUM_BL_KEYS);
  31
  32         error = ttsp_write_block_data(ts, CY_REG_BASE,
  33                                       sizeof(bl_cmd), bl_cmd);