[PATCH v2 1/3] Input: synaptics-rmi4 - f12: pass Data1-relative size to process_objects

[Dmitry Mikushin <dmitry@kernelgen.org>]

rmi_f12_process_objects() gets a pointer to Data1 and limits the number
of objects it parses by the size it is given, but rmi_f12_attention()
passes valid_bytes, which counts from the start of the F12 data packet
rather than from Data1. When Data1 is not the first data register,
the bound is too large by data1_offset bytes.

On the attention data path valid_bytes can be smaller than the full
packet, so objects may be parsed from beyond the bytes that were
actually received. Pass the number of valid bytes starting at Data1,
and skip object processing if Data1 was not received at all.

Fixes: 6d0dbeae71f0 ("Input: synaptics-rmi4 - handle incomplete input data")
Signed-off-by: Dmitry Mikushin <dmitry@kernelgen.org>
---
 drivers/input/rmi4/rmi_f12.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/input/rmi4/rmi_f12.c b/drivers/input/rmi4/rmi_f12.c
index 841884d967a3..34f24de34465 100644
--- a/drivers/input/rmi4/rmi_f12.c
+++ b/drivers/input/rmi4/rmi_f12.c
@@ -278,9 +278,9 @@ static irqreturn_t rmi_f12_attention(int irq, void *ctx)
 		}
 	}
 
-	if (f12->data1)
+	if (f12->data1 && valid_bytes > f12->data1_offset)
 		rmi_f12_process_objects(f12, &sensor->data_pkt[f12->data1_offset],
-					valid_bytes);
+					valid_bytes - f12->data1_offset);
 
 	input_mt_sync_frame(sensor->input);
 
-- 
2.56.0