[PATCH 4/8] Input: elan_i2c - use 4-argument i2c_smbus_read_block_data()
From: Dmitry Torokhov
Date: Sat Oct 24 2026 - 22:50:35 EST
Convert callers of i2c_smbus_read_block_data() to the 4-argument
variant, specifying the buffer size to avoid buffer overruns.
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@xxxxxxxxx>
---
drivers/input/mouse/elan_i2c_smbus.c | 36 +++++++++++++++++++++++-------------
1 file changed, 23 insertions(+), 13 deletions(-)
diff --git a/drivers/input/mouse/elan_i2c_smbus.c b/drivers/input/mouse/elan_i2c_smbus.c
index 0287441cda46..c5091601587a 100644
--- a/drivers/input/mouse/elan_i2c_smbus.c
+++ b/drivers/input/mouse/elan_i2c_smbus.c
@@ -59,7 +59,8 @@ static int elan_smbus_initialize(struct i2c_client *client)
/* Get hello packet */
len = i2c_smbus_read_block_data(client,
- ETP_SMBUS_HELLOPACKET_CMD, values);
+ ETP_SMBUS_HELLOPACKET_CMD,
+ sizeof(values), values);
if (len != ETP_SMBUS_HELLOPACKET_LEN) {
dev_err(&client->dev, "hello packet length fail: %d\n", len);
error = len < 0 ? len : -EIO;
@@ -120,7 +121,8 @@ static int elan_smbus_calibrate_result(struct i2c_client *client, u8 *val)
BUILD_BUG_ON(ETP_CALIBRATE_MAX_LEN > sizeof(buf));
error = i2c_smbus_read_block_data(client,
- ETP_SMBUS_CALIBRATE_QUERY, buf);
+ ETP_SMBUS_CALIBRATE_QUERY,
+ sizeof(buf), buf);
if (error < 0)
return error;
@@ -138,7 +140,7 @@ static int elan_smbus_get_baseline_data(struct i2c_client *client,
max_baseline ?
ETP_SMBUS_MAX_BASELINE_CMD :
ETP_SMBUS_MIN_BASELINE_CMD,
- val);
+ sizeof(val), val);
if (error < 0)
return error;
@@ -156,7 +158,7 @@ static int elan_smbus_get_version(struct i2c_client *client,
error = i2c_smbus_read_block_data(client,
iap ? ETP_SMBUS_IAP_VERSION_CMD :
ETP_SMBUS_FW_VERSION_CMD,
- val);
+ sizeof(val), val);
if (error < 0) {
dev_err(&client->dev, "failed to get %s version: %d\n",
iap ? "IAP" : "FW", error);
@@ -174,7 +176,8 @@ static int elan_smbus_get_sm_version(struct i2c_client *client, u8 pattern,
u8 val[I2C_SMBUS_BLOCK_MAX] = {0};
error = i2c_smbus_read_block_data(client,
- ETP_SMBUS_SM_VERSION_CMD, val);
+ ETP_SMBUS_SM_VERSION_CMD,
+ sizeof(val), val);
if (error < 0) {
dev_err(&client->dev, "failed to get SM version: %d\n", error);
return error;
@@ -192,7 +195,8 @@ static int elan_smbus_get_product_id(struct i2c_client *client, u16 *id)
u8 val[I2C_SMBUS_BLOCK_MAX] = {0};
error = i2c_smbus_read_block_data(client,
- ETP_SMBUS_UNIQUEID_CMD, val);
+ ETP_SMBUS_UNIQUEID_CMD,
+ sizeof(val), val);
if (error < 0) {
dev_err(&client->dev, "failed to get product ID: %d\n", error);
return error;
@@ -211,7 +215,7 @@ static int elan_smbus_get_checksum(struct i2c_client *client,
error = i2c_smbus_read_block_data(client,
iap ? ETP_SMBUS_FW_CHECKSUM_CMD :
ETP_SMBUS_IAP_CHECKSUM_CMD,
- val);
+ sizeof(val), val);
if (error < 0) {
dev_err(&client->dev, "failed to get %s checksum: %d\n",
iap ? "IAP" : "FW", error);
@@ -229,7 +233,8 @@ static int elan_smbus_get_max(struct i2c_client *client,
int error;
u8 val[I2C_SMBUS_BLOCK_MAX] = {0};
- ret = i2c_smbus_read_block_data(client, ETP_SMBUS_RANGE_CMD, val);
+ ret = i2c_smbus_read_block_data(client, ETP_SMBUS_RANGE_CMD,
+ sizeof(val), val);
if (ret != 3) {
error = ret < 0 ? ret : -EIO;
dev_err(&client->dev, "failed to get dimensions: %d\n", error);
@@ -249,7 +254,8 @@ static int elan_smbus_get_resolution(struct i2c_client *client,
int error;
u8 val[I2C_SMBUS_BLOCK_MAX] = {0};
- ret = i2c_smbus_read_block_data(client, ETP_SMBUS_RESOLUTION_CMD, val);
+ ret = i2c_smbus_read_block_data(client, ETP_SMBUS_RESOLUTION_CMD,
+ sizeof(val), val);
if (ret != 3) {
error = ret < 0 ? ret : -EIO;
dev_err(&client->dev, "failed to get resolution: %d\n", error);
@@ -270,7 +276,8 @@ static int elan_smbus_get_num_traces(struct i2c_client *client,
int error;
u8 val[I2C_SMBUS_BLOCK_MAX] = {0};
- ret = i2c_smbus_read_block_data(client, ETP_SMBUS_XY_TRACENUM_CMD, val);
+ ret = i2c_smbus_read_block_data(client, ETP_SMBUS_XY_TRACENUM_CMD,
+ sizeof(val), val);
if (ret != 3) {
error = ret < 0 ? ret : -EIO;
dev_err(&client->dev, "failed to get trace info: %d\n", error);
@@ -297,7 +304,8 @@ static int elan_smbus_iap_get_mode(struct i2c_client *client,
u16 constant;
u8 val[I2C_SMBUS_BLOCK_MAX] = {0};
- error = i2c_smbus_read_block_data(client, ETP_SMBUS_IAP_CTRL_CMD, val);
+ error = i2c_smbus_read_block_data(client, ETP_SMBUS_IAP_CTRL_CMD,
+ sizeof(val), val);
if (error < 0) {
dev_err(&client->dev, "failed to read iap ctrol register: %d\n",
error);
@@ -384,7 +392,7 @@ static int elan_smbus_prepare_fw_update(struct i2c_client *client, u16 ic_type,
*/
len = i2c_smbus_read_block_data(client,
ETP_SMBUS_IAP_PASSWORD_READ,
- val);
+ sizeof(val), val);
if (len < (int)sizeof(u16)) {
error = len < 0 ? len : -EIO;
dev_err(dev, "failed to read iap password: %d\n",
@@ -454,7 +462,8 @@ static int elan_smbus_write_fw_block(struct i2c_client *client, u16 fw_page_size
usleep_range(8000, 10000);
error = i2c_smbus_read_block_data(client,
- ETP_SMBUS_IAP_CTRL_CMD, val);
+ ETP_SMBUS_IAP_CTRL_CMD,
+ sizeof(val), val);
if (error < 0) {
dev_err(dev, "Failed to read IAP write result: %d\n",
error);
@@ -493,6 +502,7 @@ static int elan_smbus_get_report(struct i2c_client *client,
len = i2c_smbus_read_block_data(client,
ETP_SMBUS_PACKET_QUERY,
+ ETP_SMBUS_REPORT_LEN,
&report[ETP_SMBUS_REPORT_OFFSET]);
if (len < 0) {
dev_err(&client->dev, "failed to read report data: %d\n", len);
--
2.56.0.257.gf7497c7d27-goog