[PATCH 4/8] Input: elan_i2c - use 4-argument i2c_smbus_read_block_data()

[Dmitry Torokhov <dmitry.torokhov@gmail.com>]

Convert callers of i2c_smbus_read_block_data() to the 4-argument
variant, specifying the buffer size to avoid buffer overruns.

Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---
 drivers/input/mouse/elan_i2c_smbus.c | 36 +++++++++++++++++++++++-------------
 1 file changed, 23 insertions(+), 13 deletions(-)

diff --git a/drivers/input/mouse/elan_i2c_smbus.c b/drivers/input/mouse/elan_i2c_smbus.c
index 0287441cda46..c5091601587a 100644
--- a/drivers/input/mouse/elan_i2c_smbus.c
+++ b/drivers/input/mouse/elan_i2c_smbus.c
@@ -59,7 +59,8 @@ static int elan_smbus_initialize(struct i2c_client *client)
 
 	/* Get hello packet */
 	len = i2c_smbus_read_block_data(client,
-					ETP_SMBUS_HELLOPACKET_CMD, values);
+					ETP_SMBUS_HELLOPACKET_CMD,
+					sizeof(values), values);
 	if (len != ETP_SMBUS_HELLOPACKET_LEN) {
 		dev_err(&client->dev, "hello packet length fail: %d\n", len);
 		error = len < 0 ? len : -EIO;
@@ -120,7 +121,8 @@ static int elan_smbus_calibrate_result(struct i2c_client *client, u8 *val)
 	BUILD_BUG_ON(ETP_CALIBRATE_MAX_LEN > sizeof(buf));
 
 	error = i2c_smbus_read_block_data(client,
-					  ETP_SMBUS_CALIBRATE_QUERY, buf);
+					  ETP_SMBUS_CALIBRATE_QUERY,
+					  sizeof(buf), buf);
 	if (error < 0)
 		return error;
 
@@ -138,7 +140,7 @@ static int elan_smbus_get_baseline_data(struct i2c_client *client,
 					  max_baseline ?
 						ETP_SMBUS_MAX_BASELINE_CMD :
 						ETP_SMBUS_MIN_BASELINE_CMD,
-					  val);
+					  sizeof(val), val);
 	if (error < 0)
 		return error;
 
@@ -156,7 +158,7 @@ static int elan_smbus_get_version(struct i2c_client *client,
 	error = i2c_smbus_read_block_data(client,
 					  iap ? ETP_SMBUS_IAP_VERSION_CMD :
 						ETP_SMBUS_FW_VERSION_CMD,
-					  val);
+					  sizeof(val), val);
 	if (error < 0) {
 		dev_err(&client->dev, "failed to get %s version: %d\n",
 			iap ? "IAP" : "FW", error);
@@ -174,7 +176,8 @@ static int elan_smbus_get_sm_version(struct i2c_client *client, u8 pattern,
 	u8 val[I2C_SMBUS_BLOCK_MAX] = {0};
 
 	error = i2c_smbus_read_block_data(client,
-					  ETP_SMBUS_SM_VERSION_CMD, val);
+					  ETP_SMBUS_SM_VERSION_CMD,
+					  sizeof(val), val);
 	if (error < 0) {
 		dev_err(&client->dev, "failed to get SM version: %d\n", error);
 		return error;
@@ -192,7 +195,8 @@ static int elan_smbus_get_product_id(struct i2c_client *client, u16 *id)
 	u8 val[I2C_SMBUS_BLOCK_MAX] = {0};
 
 	error = i2c_smbus_read_block_data(client,
-					  ETP_SMBUS_UNIQUEID_CMD, val);
+					  ETP_SMBUS_UNIQUEID_CMD,
+					  sizeof(val), val);
 	if (error < 0) {
 		dev_err(&client->dev, "failed to get product ID: %d\n", error);
 		return error;
@@ -211,7 +215,7 @@ static int elan_smbus_get_checksum(struct i2c_client *client,
 	error = i2c_smbus_read_block_data(client,
 					  iap ? ETP_SMBUS_FW_CHECKSUM_CMD :
 						ETP_SMBUS_IAP_CHECKSUM_CMD,
-					  val);
+					  sizeof(val), val);
 	if (error < 0) {
 		dev_err(&client->dev, "failed to get %s checksum: %d\n",
 			iap ? "IAP" : "FW", error);
@@ -229,7 +233,8 @@ static int elan_smbus_get_max(struct i2c_client *client,
 	int error;
 	u8 val[I2C_SMBUS_BLOCK_MAX] = {0};
 
-	ret = i2c_smbus_read_block_data(client, ETP_SMBUS_RANGE_CMD, val);
+	ret = i2c_smbus_read_block_data(client, ETP_SMBUS_RANGE_CMD,
+					sizeof(val), val);
 	if (ret != 3) {
 		error = ret < 0 ? ret : -EIO;
 		dev_err(&client->dev, "failed to get dimensions: %d\n", error);
@@ -249,7 +254,8 @@ static int elan_smbus_get_resolution(struct i2c_client *client,
 	int error;
 	u8 val[I2C_SMBUS_BLOCK_MAX] = {0};
 
-	ret = i2c_smbus_read_block_data(client, ETP_SMBUS_RESOLUTION_CMD, val);
+	ret = i2c_smbus_read_block_data(client, ETP_SMBUS_RESOLUTION_CMD,
+					sizeof(val), val);
 	if (ret != 3) {
 		error = ret < 0 ? ret : -EIO;
 		dev_err(&client->dev, "failed to get resolution: %d\n", error);
@@ -270,7 +276,8 @@ static int elan_smbus_get_num_traces(struct i2c_client *client,
 	int error;
 	u8 val[I2C_SMBUS_BLOCK_MAX] = {0};
 
-	ret = i2c_smbus_read_block_data(client, ETP_SMBUS_XY_TRACENUM_CMD, val);
+	ret = i2c_smbus_read_block_data(client, ETP_SMBUS_XY_TRACENUM_CMD,
+					sizeof(val), val);
 	if (ret != 3) {
 		error = ret < 0 ? ret : -EIO;
 		dev_err(&client->dev, "failed to get trace info: %d\n", error);
@@ -297,7 +304,8 @@ static int elan_smbus_iap_get_mode(struct i2c_client *client,
 	u16 constant;
 	u8 val[I2C_SMBUS_BLOCK_MAX] = {0};
 
-	error = i2c_smbus_read_block_data(client, ETP_SMBUS_IAP_CTRL_CMD, val);
+	error = i2c_smbus_read_block_data(client, ETP_SMBUS_IAP_CTRL_CMD,
+					  sizeof(val), val);
 	if (error < 0) {
 		dev_err(&client->dev, "failed to read iap ctrol register: %d\n",
 			error);
@@ -384,7 +392,7 @@ static int elan_smbus_prepare_fw_update(struct i2c_client *client, u16 ic_type,
 		 */
 		len = i2c_smbus_read_block_data(client,
 						ETP_SMBUS_IAP_PASSWORD_READ,
-						val);
+						sizeof(val), val);
 		if (len < (int)sizeof(u16)) {
 			error = len < 0 ? len : -EIO;
 			dev_err(dev, "failed to read iap password: %d\n",
@@ -454,7 +462,8 @@ static int elan_smbus_write_fw_block(struct i2c_client *client, u16 fw_page_size
 	usleep_range(8000, 10000);
 
 	error = i2c_smbus_read_block_data(client,
-					  ETP_SMBUS_IAP_CTRL_CMD, val);
+					  ETP_SMBUS_IAP_CTRL_CMD,
+					  sizeof(val), val);
 	if (error < 0) {
 		dev_err(dev, "Failed to read IAP write result: %d\n",
 			error);
@@ -493,6 +502,7 @@ static int elan_smbus_get_report(struct i2c_client *client,
 
 	len = i2c_smbus_read_block_data(client,
 					ETP_SMBUS_PACKET_QUERY,
+					ETP_SMBUS_REPORT_LEN,
 					&report[ETP_SMBUS_REPORT_OFFSET]);
 	if (len < 0) {
 		dev_err(&client->dev, "failed to read report data: %d\n", len);

-- 
2.56.0.257.gf7497c7d27-goog