[PATCH 1/2] Input: cs40l50 - fix OWT upload length

[Ismail Tarim]

cs40l50_upload_owt() passes the size of the effect in bytes as the
val_count argument of regmap_bulk_write(). The cs40l50 regmap uses
32-bit registers, so val_count is a number of registers and the call
covers four times the intended length.

regmap_bulk_write() copies val_count * val_bytes bytes from the source
buffer, so this reads past the end of new_owt_effect_data, which is
only sizeof(header) + len bytes long, and writes the extra data to the
DSP beyond the end of the uploaded effect. The free space check above
only covers the real size of the effect, so the write can also go past
the space reported as available in the open wavetable.

Pass the length in 32-bit words, matching header.data_words.

Fixes: c38fe1bb5d21 ("Input: cs40l50 - Add support for the CS40L50 haptic driver")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Ismail Tarim <ismailtarim7@xxxxxxxxx>
---
Build-tested only (W=1, x86_64 defconfig with the CS40L50 drivers as
modules). I do not have CS40L50 hardware, so this was not runtime
tested.

 drivers/input/misc/cs40l50-vibra.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/input/misc/cs40l50-vibra.c b/drivers/input/misc/cs40l50-vibra.c
index 7ef4534fe..68f0c40ef 100644
--- a/drivers/input/misc/cs40l50-vibra.c
+++ b/drivers/input/misc/cs40l50-vibra.c
@@ -250,7 +250,7 @@ static int cs40l50_upload_owt(struct cs40l50_work *work_data)
 
 	error = regmap_bulk_write(vib->regmap, vib->dsp.owt_base_reg +
 				  (offset * sizeof(u32)), new_owt_effect_data,
-				  sizeof(header) + len);
+				  (sizeof(header) + len) / sizeof(u32));
 	if (error)
 		return error;
 
-- 
2.56.0