diff options
| author | Dmitry Torokhov <dmitry.torokhov@gmail.com> | 2014-08-11 10:58:29 -0700 |
|---|---|---|
| committer | Dmitry Torokhov <dmitry.torokhov@gmail.com> | 2014-08-13 09:16:11 -0700 |
| commit | 041fa15951d0fb349d24c5619f35de1878bd030e (patch) | |
| tree | 6154947c7d5f2bc74f1074360ba0b8ad9a09d389 /drivers/input | |
| parent | efdbd7ae44f35cbb2b29d825640b917723319f7b (diff) | |
| download | linux-stable-041fa15951d0fb349d24c5619f35de1878bd030e.tar.gz linux-stable-041fa15951d0fb349d24c5619f35de1878bd030e.tar.bz2 linux-stable-041fa15951d0fb349d24c5619f35de1878bd030e.zip | |
Input: atmel_mxt_ts - fix a few issues reported by Coverity
This should fix the following issues reported by Coverity:
*** CID 1230625: Logically dead code (DEADCODE)
/drivers/input/touchscreen/atmel_mxt_ts.c: 1692 in mxt_initialize()
*** CID 1230627: Missing break in switch (MISSING_BREAK)
/drivers/input/touchscreen/atmel_mxt_ts.c: 1436 in mxt_get_object_table()
*** CID 1230629: Out-of-bounds write (OVERRUN)
/drivers/input/touchscreen/atmel_mxt_ts.c: 1267 in mxt_update_cfg()
*** CID 1230632: Unused pointer value (UNUSED_VALUE)
/drivers/input/touchscreen/atmel_mxt_ts.c: 1211 in mxt_update_cfg()
Acked-by: Nick Dyer <nick.dyer@itdev.co.uk>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Diffstat (limited to 'drivers/input')
| -rw-r--r-- | drivers/input/touchscreen/atmel_mxt_ts.c | 17 |
1 files changed, 11 insertions, 6 deletions
diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c b/drivers/input/touchscreen/atmel_mxt_ts.c index bbaf3ff680ed..db178ed2b47e 100644 --- a/drivers/input/touchscreen/atmel_mxt_ts.c +++ b/drivers/input/touchscreen/atmel_mxt_ts.c @@ -1098,8 +1098,12 @@ static int mxt_prepare_cfg_mem(struct mxt_data *data, /* Skip object */ for (i = 0; i < size; i++) { ret = sscanf(cfg->data + data_pos, "%hhx%n", - &val, - &offset); + &val, &offset); + if (ret != 1) { + dev_err(dev, "Bad format in T%d at %d\n", + type, i); + return -EINVAL; + } data_pos += offset; } continue; @@ -1139,7 +1143,8 @@ static int mxt_prepare_cfg_mem(struct mxt_data *data, &val, &offset); if (ret != 1) { - dev_err(dev, "Bad format in T%d\n", type); + dev_err(dev, "Bad format in T%d at %d\n", + type, i); return -EINVAL; } data_pos += offset; @@ -1149,8 +1154,7 @@ static int mxt_prepare_cfg_mem(struct mxt_data *data, byte_offset = reg + i - cfg_start_ofs; - if (byte_offset >= 0 && - byte_offset <= config_mem_size) { + if (byte_offset >= 0 && byte_offset < config_mem_size) { *(config_mem + byte_offset) = val; } else { dev_err(dev, "Bad object: reg:%d, T%d, ofs=%d\n", @@ -1454,6 +1458,7 @@ static int mxt_get_object_table(struct mxt_data *data) data->T5_msg_size = mxt_obj_size(object) - 1; } data->T5_address = object->start_address; + break; case MXT_GEN_COMMAND_T6: data->T6_reportid = min_id; data->T6_address = object->start_address; @@ -1707,7 +1712,7 @@ static int mxt_initialize(struct mxt_data *data) return error; } - mxt_acquire_irq(data); + error = mxt_acquire_irq(data); if (error) goto err_free_object_table; |