]> git.baikalelectronics.ru Git - kernel.git/commit
HID: wacom: Avoid using stale array indicies to read contact count
authorJason Gerecke <killertofu@gmail.com>
Tue, 18 Jan 2022 22:38:41 +0000 (14:38 -0800)
committerJiri Kosina <jkosina@suse.cz>
Fri, 21 Jan 2022 14:10:02 +0000 (15:10 +0100)
commit82ff1404ff458ce56efea53b8094284b4c8adfa5
tree21ecced4eb831f36e54ae81585eb54cd102f0780
parenta595463920602a80b87ed3cc10115e6c3c45531b
HID: wacom: Avoid using stale array indicies to read contact count

If we ever see a touch report with contact count data we initialize
several variables used to read the contact count in the pre-report
phase. These variables are never reset if we process a report which
doesn't contain a contact count, however. This can cause the pre-
report function to trigger a read of arbitrary memory (e.g. NULL
if we're lucky) and potentially crash the driver.

This commit restores resetting of the variables back to default
"none" values that were used prior to the commit mentioned
below.

Link: https://github.com/linuxwacom/input-wacom/issues/276
Fixes: f81b0b2024ae (HID: wacom: Update last_slot_field during pre_report phase)
CC: stable@vger.kernel.org
Signed-off-by: Jason Gerecke <jason.gerecke@wacom.com>
Reviewed-by: Ping Cheng <ping.cheng@wacom.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
drivers/hid/wacom_wac.c