Patchwork [3.5.y.z,extended,stable] Patch "Input: cyttsp - fix memcpy size param" has been added to staging queue

mail settings
Submitter Luis Henriques
Date June 25, 2013, 9:30 a.m.
Message ID <>
Download mbox | patch
Permalink /patch/254088/
State New
Headers show


Luis Henriques - June 25, 2013, 9:30 a.m.
This is a note to let you know that I have just added a patch titled

    Input: cyttsp - fix memcpy size param

to the linux-3.5.y-queue branch of the 3.5.y.z extended stable tree 
which can be found at:;a=shortlog;h=refs/heads/linux-3.5.y-queue

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.5.y.z tree, see



From d96fe9bd3e5c73d9b49f40b70fbe781768c776cd Mon Sep 17 00:00:00 2001
From: Ferruh Yigit <>
Date: Thu, 23 May 2013 09:56:55 -0700
Subject: [PATCH] Input: cyttsp - fix memcpy size param

commit d2983cdb480157f637df07723f28aaa657b1080d upstream.

memcpy param is wrong because of offset in bl_cmd, this may corrupt the
stack which may cause a crash.

Tested-by: Ferruh Yigit <> on TMA300-DVK
Signed-off-by: Ferruh Yigit <>
Acked-by: Javier Martinez Canillas <>
Signed-off-by: Dmitry Torokhov <>
Signed-off-by: Luis Henriques <>
 drivers/input/touchscreen/cyttsp_core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)



diff --git a/drivers/input/touchscreen/cyttsp_core.c b/drivers/input/touchscreen/cyttsp_core.c
index f030d9e..3f505d5 100644
--- a/drivers/input/touchscreen/cyttsp_core.c
+++ b/drivers/input/touchscreen/cyttsp_core.c
@@ -133,7 +133,7 @@  static int cyttsp_exit_bl_mode(struct cyttsp *ts)
 	memcpy(bl_cmd, bl_command, sizeof(bl_command));
 	if (ts->pdata->bl_keys)
 		memcpy(&bl_cmd[sizeof(bl_command) - CY_NUM_BL_KEYS],
-			ts->pdata->bl_keys, sizeof(bl_command));
+			ts->pdata->bl_keys, CY_NUM_BL_KEYS);

 	error = ttsp_write_block_data(ts, CY_REG_BASE,
 				      sizeof(bl_cmd), bl_cmd);