summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorPixelBot AutoMerger <android-nexus-securitybot@system.gserviceaccount.com>2023-09-24 18:27:16 -0700
committerPindar Yang <pindaryang@google.com>2023-09-25 06:43:12 +0000
commitae6115e7ae2fb66c3ccd731353e754b275390fb1 (patch)
tree58c0c0947ed6fc346e769d6458a0e7994c905883
parente12981fdacd1de8d2205b44dfff75aee30382c52 (diff)
parentc3e90e2c6e1d20dad416213e13765cdac94cd0ac (diff)
downloadfelix-ae6115e7ae2fb66c3ccd731353e754b275390fb1.tar.gz
Bug: 300854197 SBMerger: 558810260 Change-Id: I7ee0ed2d1199756371d81fc5a78987242d307789 Signed-off-by: SecurityBot <android-nexus-securitybot@system.gserviceaccount.com>
-rw-r--r--touch/ftm5/fts.c5
-rw-r--r--touch/ftm5/fts_lib/ftsSoftware.h1
2 files changed, 6 insertions, 0 deletions
diff --git a/touch/ftm5/fts.c b/touch/ftm5/fts.c
index 38801ab..daf8863 100644
--- a/touch/ftm5/fts.c
+++ b/touch/ftm5/fts.c
@@ -3877,6 +3877,11 @@ static irqreturn_t fts_interrupt_handler(int irq, void *handle)
for (count = 0; count < events_remaining + 1; count++) {
evt_data = &data[count * FIFO_EVENT_SIZE];
+ if (!VALID_EVENT_TYPE(evt_data[0])) {
+ dev_err(info->dev, "Got invalid event type: %*ph\n", 8, evt_data);
+ goto exit;
+ }
+
switch (GET_EVENT_TYPE(evt_data[0])) {
case EVT_ID_CONTROLLER_READY:
case EVT_ID_ERROR:
diff --git a/touch/ftm5/fts_lib/ftsSoftware.h b/touch/ftm5/fts_lib/ftsSoftware.h
index 14e45e8..8090bc0 100644
--- a/touch/ftm5/fts_lib/ftsSoftware.h
+++ b/touch/ftm5/fts_lib/ftsSoftware.h
@@ -375,6 +375,7 @@ enum {
/** @}*/
/* bit2 and bit3 are for major data so skip it. */
#define GET_EVENT_TYPE(event_data) (event_data & 0xF3)
+#define VALID_EVENT_TYPE(event_data) ((event_data & 0x03) == 0x03)
/* EVENT ID */
/** @defgroup events_group FW Event IDs and Types
* Event IDs and Types pushed by the FW into the FIFO