[PATCH 1/2] Input: cs40l50 - fix OWT upload length

[PATCH 1/2] Input: cs40l50 - fix OWT upload length

[Ismail Tarim]

cs40l50_upload_owt() passes the size of the effect in bytes as the
val_count argument of regmap_bulk_write(). The cs40l50 regmap uses
32-bit registers, so val_count is a number of registers and the call
covers four times the intended length.

regmap_bulk_write() copies val_count * val_bytes bytes from the source
buffer, so this reads past the end of new_owt_effect_data, which is
only sizeof(header) + len bytes long, and writes the extra data to the
DSP beyond the end of the uploaded effect. The free space check above
only covers the real size of the effect, so the write can also go past
the space reported as available in the open wavetable.

Pass the length in 32-bit words, matching header.data_words.

Fixes: c38fe1bb5d21 ("Input: cs40l50 - Add support for the CS40L50 haptic driver")
Cc: stable@vger.kernel.org
Signed-off-by: Ismail Tarim <ismailtarim7@gmail.com>
---
Build-tested only (W=1, x86_64 defconfig with the CS40L50 drivers as
modules). I do not have CS40L50 hardware, so this was not runtime
tested.

 drivers/input/misc/cs40l50-vibra.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/input/misc/cs40l50-vibra.c b/drivers/input/misc/cs40l50-vibra.c
index 7ef4534fe..68f0c40ef 100644
--- a/drivers/input/misc/cs40l50-vibra.c
+++ b/drivers/input/misc/cs40l50-vibra.c
@@ -250,7 +250,7 @@ static int cs40l50_upload_owt(struct cs40l50_work *work_data)
 
 	error = regmap_bulk_write(vib->regmap, vib->dsp.owt_base_reg +
 				  (offset * sizeof(u32)), new_owt_effect_data,
-				  sizeof(header) + len);
+				  (sizeof(header) + len) / sizeof(u32));
 	if (error)
 		return error;
 
-- 
2.56.0

[PATCH 2/2] Input: cs40l50 - fix work item leak in stop worker

[Ismail Tarim]

cs40l50_playback() allocates a work item for every playback request,
and the start and stop workers are responsible for freeing it.
cs40l50_stop_worker() returns early when pm_runtime_resume_and_get()
fails and never frees the item.

Free it on that path too, as cs40l50_start_worker() already does.

Fixes: c38fe1bb5d21 ("Input: cs40l50 - Add support for the CS40L50 haptic driver")
Signed-off-by: Ismail Tarim <ismailtarim7@gmail.com>
---
Build-tested only (W=1, x86_64 defconfig with the CS40L50 drivers as
modules). I do not have CS40L50 hardware, so this was not runtime
tested.

 drivers/input/misc/cs40l50-vibra.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/input/misc/cs40l50-vibra.c b/drivers/input/misc/cs40l50-vibra.c
index 68f0c40ef..cbe69f6c7 100644
--- a/drivers/input/misc/cs40l50-vibra.c
+++ b/drivers/input/misc/cs40l50-vibra.c
@@ -384,12 +384,12 @@ static void cs40l50_stop_worker(struct work_struct *work)
 	struct cs40l50_vibra *vib = work_data->vib;
 
 	if (pm_runtime_resume_and_get(vib->dev) < 0)
-		return;
+		goto err_free;
 
 	vib->dsp.write(vib->dev, vib->regmap, vib->dsp.stop_cmd);
 
 	pm_runtime_put_autosuspend(vib->dev);
-
+err_free:
 	kfree(work_data);
 }
 
-- 
2.56.0