linux-stable.git/drivers/input/touchscreen/touchwin.c, branch linux-rolling-lts

Input: touchwin - reset the packet index on every complete packet

2026-07-18T14:53:34+00:00

commit 478cdd736f2ce3114f90e775d7358136d3977b94 upstream.

tw_interrupt() accumulates each non-zero serial byte into a fixed
three-byte buffer with a running index that is only reset once a full
packet has been received *and* the device's two Y bytes agree:

	tw->data[tw->idx++] = data;
	if (tw->idx == TW_LENGTH && tw->data[1] == tw->data[2]) {
		...
		tw->idx = 0;
	}

The reset is gated on tw->data[1] == tw->data[2], a value the device
controls.  A malicious, malfunctioning or counterfeit Touchwindow
peripheral can stream non-zero bytes whose 2nd and 3rd bytes differ: the
index reaches TW_LENGTH without the equality holding, is never reset, and
keeps growing, so tw->data[tw->idx++] walks off the end of the three-byte
array and the rest of the heap-allocated struct tw, one attacker-chosen
byte at a time -- an unbounded, device-driven heap out-of-bounds write.

Reset the index on every completed packet and report an event only when
the two Y bytes match, like the other serio touchscreen drivers do.

Fixes: 11ea3173d5f2 ("Input: add driver for Touchwin serial touchscreens")
Cc: stable@vger.kernel.org
Signed-off-by: Bryam Vargas 
Link: https://patch.msgid.link/20260613-b4-disp-69921bfd-v1-1-82c036899959@proton.me
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Greg Kroah-Hartman

Input: touchscreen - use sizeof(*pointer) instead of sizeof(type)

2024-06-09T21:38:38+00:00

It is preferred to use sizeof(*pointer) instead of sizeof(type)
due to the type of the variable can change and one needs not
change the former (unlike the latter).

The refactoring is mostly trivial except for "usbtouchscreen.c"
file. Here, in the "mtouch_alloc" and "nexio_alloc" functions,
it is necessary to use a variable with a predefined type instead
of the "usbtouch->priv" variable (void * type). This way, the
"sizeof" operator can now know the correct size. Moreover, we
need to set the "usbtouch->priv" pointer after the memory
allocation since now the "kmalloc" return value is not assigned
directly.

This patch has no effect on runtime behavior.

Signed-off-by: Erick Archer 
Link: https://lore.kernel.org/r/AS8PR02MB723708364CC0DF2EAAFEE5968BC42@AS8PR02MB7237.eurprd02.prod.outlook.com
Signed-off-by: Dmitry Torokhov

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500

2019-06-19T15:09:55+00:00

Based on 2 normalized pattern(s):

  this program is free software you can redistribute it and or modify
  it under the terms of the gnu general public license version 2 as
  published by the free software foundation

  this program is free software you can redistribute it and or modify
  it under the terms of the gnu general public license version 2 as
  published by the free software foundation #

extracted by the scancode license scanner the SPDX license identifier

  GPL-2.0-only

has been chosen to replace the boilerplate/reference in 4122 file(s).

Signed-off-by: Thomas Gleixner 
Reviewed-by: Enrico Weigelt 
Reviewed-by: Kate Stewart 
Reviewed-by: Allison Randal 
Cc: linux-spdx@vger.kernel.org
Link: https://lkml.kernel.org/r/20190604081206.933168790@linutronix.de
Signed-off-by: Greg Kroah-Hartman

Input: touchwin - constify serio_device_id

2017-08-19T00:15:37+00:00

serio_device_id are not supposed to change at runtime. All functions
working with serio_device_id provided by  work with
const serio_device_id. So mark the non-const structs as const.

Signed-off-by: Arvind Yadav 
Signed-off-by: Dmitry Torokhov

Input: delete non-required instances of include

2014-01-07T07:23:57+00:00

None of these files are actually using any __init type directives
and hence don't need to include .  Most are just a
left over from __devinit and __cpuinit removal, or simply due to
code getting copied from one driver to the next.

Signed-off-by: Paul Gortmaker 
Signed-off-by: Dmitry Torokhov

Input: serio - use module_serio_driver

2012-04-04T16:25:43+00:00

This patch converts the drivers in drivers/input/* to use
module_serio_driver() macro which makes the code smaller and
a bit simpler.

Signed-off-by: Axel Lin 
Signed-off-by: Dmitry Torokhov

get rid of input BIT* duplicate defines

2007-10-19T18:53:42+00:00

get rid of input BIT* duplicate defines

use newly global defined macros for input layer. Also remove includes of
input.h from non-input sources only for BIT macro definiton. Define the
macro temporarily in local manner, all those local definitons will be
removed further in this patchset (to not break bisecting).
BIT macro will be globally defined (1<
Cc: 
Acked-by: Jiri Kosina 
Cc: 
Acked-by: Marcel Holtmann 
Cc: 
Acked-by: Mauro Carvalho Chehab 
Cc: 
Cc: 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

Input: touchscreens - switch to using input_dev->dev.parent

2007-04-12T05:35:14+00:00

In preparation for struct class_device -> struct device input
core conversion, switch to using input_dev->dev.parent when
specifying device position in sysfs tree.

Signed-off-by: Dmitry Torokhov

Input: drivers/input/touchscreen - don't access dev->private directly

2007-04-12T05:34:08+00:00

Use input_get_drvdata() and input_set_drvdata() instead.

Signed-off-by: Dmitry Torokhov

Input: handle serio_register_driver() errors

2006-11-24T04:35:10+00:00

Signed-off-by: Akinobu Mita 
Signed-off-by: Dmitry Torokhov