[PATCH] Input: mx25-tcq - clamp the FIFO sample count to the buffer size

[Liu Chao]

MX25_ADCQ_SR_FDN() reports up to 31 pending samples.  The IRQ thread
aligns the count down to a multiple of the sample count but never
bounds it by the size of sample_buf, so a FIFO backlog larger than
TSC_MAX_SAMPLES overruns the stack buffer.

Clamp the count before the alignment so that the result stays a
multiple of sample_count.

Fixes: 4f7ed234f2a5 ("Input: touchscreen: Add imx25 TCQ driver")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Liu Chao <liuc63@xxxxxxxxxxxx>
---
 drivers/input/touchscreen/fsl-imx25-tcq.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/input/touchscreen/fsl-imx25-tcq.c b/drivers/input/touchscreen/fsl-imx25-tcq.c
index ff270b3b8572..fa8d8b736723 100644
--- a/drivers/input/touchscreen/fsl-imx25-tcq.c
+++ b/drivers/input/touchscreen/fsl-imx25-tcq.c
@@ -319,6 +319,7 @@ static irqreturn_t mx25_tcq_irq_thread(int irq, void *dev_id)
 	 */
 	regmap_read(priv->regs, MX25_ADCQ_SR, &stats);
 	samples = MX25_ADCQ_SR_FDN(stats);
+	samples = min_t(unsigned int, samples, TSC_MAX_SAMPLES);
 	samples -= samples % priv->sample_count;
 
 	if (!samples)
-- 
2.50.1