]> git.ipfire.org Git - thirdparty/linux.git/commitdiff
Input: ims-pcu - fix logic error in packet reset
authorDmitry Torokhov <dmitry.torokhov@gmail.com>
Fri, 22 May 2026 17:29:41 +0000 (10:29 -0700)
committerDmitry Torokhov <dmitry.torokhov@gmail.com>
Sun, 7 Jun 2026 03:57:26 +0000 (20:57 -0700)
ims_pcu_reset_packet() incorrectly sets have_stx to true, which implies
that the start-of-packet delimiter has already been received. This
causes the protocol parser to skip waiting for the next STX byte and
potentially process garbage data.

Correctly set have_stx to false when resetting the packet state.

Fixes: 875115b82c29 ("Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data()")
Cc: stable@vger.kernel.org
Reported-by: Sashiko bot <sashiko-bot@kernel.org>
Assisted-by: Gemini:gemini-3.1-pro
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
drivers/input/misc/ims-pcu.c

index 1383db382bc94796c1a2c89e425c5e4789f1e7f6..32b5b01b2f2e9a099ddd6f4aaff73a1af7fb21c4 100644 (file)
@@ -441,7 +441,7 @@ static void ims_pcu_handle_response(struct ims_pcu *pcu)
 
 static void ims_pcu_reset_packet(struct ims_pcu *pcu)
 {
-       pcu->have_stx = true;
+       pcu->have_stx = false;
        pcu->have_dle = false;
        pcu->read_pos = 0;
        pcu->check_sum = 0;