From cd5ebc4a196669174f1d2a75e06bf30bd3e9d15c Mon Sep 17 00:00:00 2001 From: Jeff LaBundy Date: Fri, 1 Jun 2018 08:43:47 -0500 Subject: [PATCH] misc: cs40l2x: Add bounds checking to timeout controls Added a safety check to ensure that the values written to the gpio1_fall_timeout and standby_timeout controls do not exceed the maximum value supported by the DSP. Change-Id: I8b5dca1f5013acb2d06688af577d0214ce956559 Signed-off-by: Jeff LaBundy Signed-off-by: Ravi Vembu --- drivers/misc/cs40l2x.c | 6 ++++++ drivers/misc/cs40l2x.h | 3 +++ 2 files changed, 9 insertions(+) diff --git a/drivers/misc/cs40l2x.c b/drivers/misc/cs40l2x.c index edd81c42487f..ab738f6d2635 100644 --- a/drivers/misc/cs40l2x.c +++ b/drivers/misc/cs40l2x.c @@ -523,6 +523,9 @@ static ssize_t cs40l2x_gpio1_fall_timeout_store(struct device *dev, if (ret) return -EINVAL; + if (val > CS40L2X_PR_TIMEOUT_MAX) + return -EINVAL; + mutex_lock(&cs40l2x->lock); ret = regmap_write(cs40l2x->regmap, cs40l2x_dsp_reg(cs40l2x, "PRESS_RELEASE_TIMEOUT", @@ -570,6 +573,9 @@ static ssize_t cs40l2x_standby_timeout_store(struct device *dev, if (ret) return -EINVAL; + if (val > CS40L2X_EVENT_TIMEOUT_MAX) + return -EINVAL; + mutex_lock(&cs40l2x->lock); ret = regmap_write(cs40l2x->regmap, cs40l2x_dsp_reg(cs40l2x, "EVENT_TIMEOUT", diff --git a/drivers/misc/cs40l2x.h b/drivers/misc/cs40l2x.h index e08bf5149583..8dc895ec2bd1 100644 --- a/drivers/misc/cs40l2x.h +++ b/drivers/misc/cs40l2x.h @@ -680,6 +680,9 @@ #define CS40L2X_COEFF_LENGTH_SIZE 4 #define CS40L2X_TIMEOUT_MS_MAX 0x02AAAA /* ~174 sec */ +#define CS40L2X_PR_TIMEOUT_MAX 0x7FFFFF +#define CS40L2X_EVENT_TIMEOUT_MAX CS40L2X_PR_TIMEOUT_MAX + #define CS40L2X_HALO_STATE_RUNNING 0x2 #define CS40L2X_STATUS_IDLE 0xFFFFFF