forge/linux-pinenote
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Input: atmel_mxt_ts - fix a few issues reported by Coverity

Browse source 
This should fix the following issues reported by Coverity:

*** CID 1230625:  Logically dead code  (DEADCODE)
/drivers/input/touchscreen/atmel_mxt_ts.c: 1692 in mxt_initialize()

*** CID 1230627:  Missing break in switch  (MISSING_BREAK)
/drivers/input/touchscreen/atmel_mxt_ts.c: 1436 in mxt_get_object_table()

*** CID 1230629:  Out-of-bounds write  (OVERRUN)
/drivers/input/touchscreen/atmel_mxt_ts.c: 1267 in mxt_update_cfg()

*** CID 1230632:  Unused pointer value  (UNUSED_VALUE)
/drivers/input/touchscreen/atmel_mxt_ts.c: 1211 in mxt_update_cfg()

Acked-by: Nick Dyer <nick.dyer@itdev.co.uk>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
This commit is contained in:
Dmitry Torokhov 2014-08-11 10:58:29 -07:00
commit 041fa15951
1 changed files with 11 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

17
drivers/input/touchscreen/atmel_mxt_ts.c
View file

@ -1098,8 +1098,12 @@ static int mxt_prepare_cfg_mem(struct mxt_data *data,
/* Skip object */ /* Skip object */
for (i = 0; i < size; i++) { for (i = 0; i < size; i++) {
ret = sscanf(cfg->data + data_pos, "%hhx%n", ret = sscanf(cfg->data + data_pos, "%hhx%n",
&val, &val, &offset);
&offset); if (ret != 1) {
dev_err(dev, "Bad format in T%d at %d\n",
type, i);
return -EINVAL;
}
data_pos += offset; data_pos += offset;
} }
continue; continue;
@ -1139,7 +1143,8 @@ static int mxt_prepare_cfg_mem(struct mxt_data *data,
&val, &val,
&offset); &offset);
if (ret != 1) { if (ret != 1) {
dev_err(dev, "Bad format in T%d\n", type); dev_err(dev, "Bad format in T%d at %d\n",
type, i);
return -EINVAL; return -EINVAL;
} }
data_pos += offset; data_pos += offset;
@ -1149,8 +1154,7 @@ static int mxt_prepare_cfg_mem(struct mxt_data *data,
byte_offset = reg + i - cfg_start_ofs; byte_offset = reg + i - cfg_start_ofs;
if (byte_offset >= 0 && if (byte_offset >= 0 && byte_offset < config_mem_size) {
byte_offset <= config_mem_size) {
*(config_mem + byte_offset) = val; *(config_mem + byte_offset) = val;
} else { } else {
dev_err(dev, "Bad object: reg:%d, T%d, ofs=%d\n", dev_err(dev, "Bad object: reg:%d, T%d, ofs=%d\n",
@ -1454,6 +1458,7 @@ static int mxt_get_object_table(struct mxt_data *data)
data->T5_msg_size = mxt_obj_size(object) - 1; data->T5_msg_size = mxt_obj_size(object) - 1;
} }
data->T5_address = object->start_address; data->T5_address = object->start_address;
break;
case MXT_GEN_COMMAND_T6: case MXT_GEN_COMMAND_T6:
data->T6_reportid = min_id; data->T6_reportid = min_id;
data->T6_address = object->start_address; data->T6_address = object->start_address;
@ -1707,7 +1712,7 @@ static int mxt_initialize(struct mxt_data *data)
return error; return error;
} }
mxt_acquire_irq(data); error = mxt_acquire_irq(data);
if (error) if (error)
goto err_free_object_table; goto err_free_object_table;