3 files changed, 14 insertions, 9 deletions

diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c
index 0e761d079dc4..6d6b092e2da9 100644
--- a/drivers/input/mouse/elan_i2c_core.c
+++ b/drivers/input/mouse/elan_i2c_core.c
@@ -1258,6 +1258,7 @@ static const struct acpi_device_id elan_acpi_id[] = {
         { "ELAN0605", 0 },
         { "ELAN0609", 0 },
         { "ELAN060B", 0 },
+        { "ELAN0611", 0 },
         { "ELAN1000", 0 },
         { }
 };
diff --git a/drivers/input/rmi4/rmi_f30.c b/drivers/input/rmi4/rmi_f30.c
index 34dfee555b20..82e0f0d43d55 100644
--- a/drivers/input/rmi4/rmi_f30.c
+++ b/drivers/input/rmi4/rmi_f30.c
@@ -232,9 +232,10 @@ static int rmi_f30_map_gpios(struct rmi_function *fn,
         unsigned int trackstick_button = BTN_LEFT;
         bool button_mapped = false;
         int i;
+        int button_count = min_t(u8, f30->gpioled_count, TRACKSTICK_RANGE_END);
 
         f30->gpioled_key_map = devm_kcalloc(&fn->dev,
-                                            f30->gpioled_count,
+                                            button_count,
                                             sizeof(f30->gpioled_key_map[0]),
                                             GFP_KERNEL);
         if (!f30->gpioled_key_map) {
@@ -242,7 +243,7 @@ static int rmi_f30_map_gpios(struct rmi_function *fn,
                 return -ENOMEM;
         }
 
-        for (i = 0; i < f30->gpioled_count; i++) {
+        for (i = 0; i < button_count; i++) {
                 if (!rmi_f30_is_valid_button(i, f30->ctrl))
                         continue;
 
diff --git a/drivers/input/tablet/gtco.c b/drivers/input/tablet/gtco.c
index b796e891e2ee..4b8b9d7aa75e 100644
--- a/drivers/input/tablet/gtco.c
+++ b/drivers/input/tablet/gtco.c
@@ -230,13 +230,17 @@ static void parse_hid_report_descriptor(struct gtco *device, char * report,
 
         /* Walk  this report and pull out the info we need */
         while (i < length) {
-                prefix = report[i];
-
-                /* Skip over prefix */
-                i++;
+                prefix = report[i++];
 
                 /* Determine data size and save the data in the proper variable */
-                size = PREF_SIZE(prefix);
+                size = (1U << PREF_SIZE(prefix)) >> 1;
+                if (i + size > length) {
+                        dev_err(ddev,
+                                "Not enough data (need %d, have %d)\n",
+                                i + size, length);
+                        break;
+                }
+
                 switch (size) {
                 case 1:
                         data = report[i];
@@ -244,8 +248,7 @@ static void parse_hid_report_descriptor(struct gtco *device, char * report,
                 case 2:
                         data16 = get_unaligned_le16(&report[i]);
                         break;
-                case 3:
-                        size = 4;
+                case 4:
                         data32 = get_unaligned_le32(&report[i]);
                         break;
                 }