[PATCH] Input: hynitron-cst816x - ignore unsupported gestures

[PATCH] Input: hynitron-cst816x - ignore unsupported gestures

[Jianing Li]

The controller reports 0x05 for single click and 0x0b for double
click, while the binding only defines keycode mappings for the four
swipe gestures and long press. cst816x_gest_idx() currently maps every
other nonzero gesture to the long-press slot, so unsupported gesture
IDs can be reported using the long-press keycode.

Return an invalid slot for unsupported gesture IDs and check it against
the number of configured keycodes before reporting the event.

Fixes: c87a819bec86 ("Input: add driver for Hynitron CST816x series")
Cc: stable@vger.kernel.org
Signed-off-by: Jianing Li <m13940358460@163.com>
---
 drivers/input/touchscreen/hynitron-cst816x.c | 19 ++++++++-----------
 1 file changed, 8 insertions(+), 11 deletions(-)

diff --git a/drivers/input/touchscreen/hynitron-cst816x.c b/drivers/input/touchscreen/hynitron-cst816x.c
index 47d9cd7412d1b..d0668ac96f9af 100644
--- a/drivers/input/touchscreen/hynitron-cst816x.c
+++ b/drivers/input/touchscreen/hynitron-cst816x.c
@@ -92,24 +92,19 @@ static int cst816x_i2c_read_register(struct cst816x_priv *priv, u8 reg,
 	return 0;
 }
 
-static u8 cst816x_gest_idx(u8 gest)
+static unsigned int cst816x_gest_idx(u8 gest)
 {
-	u8 index;
-
 	switch (gest) {
 	case 0x01: /* Slide up gesture */
 	case 0x02: /* Slide down gesture */
 	case 0x03: /* Slide left gesture */
 	case 0x04: /* Slide right gesture */
-		index = gest;
-		break;
+		return gest - 1;
 	case 0x0c: /* Long press gesture */
+		return CST816X_NUM_KEYS - 1;
 	default:
-		index = CST816X_NUM_KEYS;
-		break;
+		return CST816X_NUM_KEYS;
 	}
-
-	return index - 1;
 }
 
 static bool cst816x_process_touch(struct cst816x_priv *priv,
@@ -169,6 +164,7 @@ static irqreturn_t cst816x_irq_cb(int irq, void *cookie)
 {
 	struct cst816x_priv *priv = cookie;
 	struct cst816x_touch tch;
+	unsigned int gest_idx;
 
 	if (!cst816x_process_touch(priv, &tch))
 		return IRQ_HANDLED;
@@ -176,9 +172,10 @@ static irqreturn_t cst816x_irq_cb(int irq, void *cookie)
 	input_report_abs(priv->input, ABS_X, tch.abs_x);
 	input_report_abs(priv->input, ABS_Y, tch.abs_y);
 
-	if (tch.gest)
+	gest_idx = cst816x_gest_idx(tch.gest);
+	if (gest_idx < priv->keycodemax)
 		input_report_key(priv->input,
-				 priv->keycode[cst816x_gest_idx(tch.gest)],
+				 priv->keycode[gest_idx],
 				 tch.active);
 
 	input_report_key(priv->input, BTN_TOUCH, tch.active);
-- 
2.23.0.windows.1

Re: [PATCH] Input: hynitron-cst816x - ignore unsupported gestures

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The driver passes stack-allocated variables (`tch` and `reg`) as buffers to `i2c_transfer()`. Since stack memory in modern kernels is mapped in virtual memory (VMAP_STACK) and is not guaranteed to be physically contiguous or DMA-safe, this may cause a kernel panic or silent memory corruption if the underlying I2C adapter attempts to use DMA.
--

--- Patch [1]: [PATCH] Input: hynitron-cst816x - ignore unsupported gestures ---
commit ac0089fd4854af750c6a0b96cd68ac7ac4980ba9
Author: Jianing Li <m13940358460@163.com>

Input: hynitron-cst816x - ignore unsupported gestures

This commit modifies the CST816x touchscreen driver to ignore unsupported
gesture IDs. It returns an invalid slot for unsupported gestures and checks
it against the configured keycodes before reporting the event.

> diff --git a/drivers/input/touchscreen/hynitron-cst816x.c b/drivers/input/touchscreen/hynitron-cst816x.c
> index 47d9cd7412d1b..d0668ac96f9af 100644
> --- a/drivers/input/touchscreen/hynitron-cst816x.c
> +++ b/drivers/input/touchscreen/hynitron-cst816x.c

[ ... ]

> @@ -169,6 +164,7 @@ static irqreturn_t cst816x_irq_cb(int irq, void *cookie)
>  {
>  	struct cst816x_priv *priv = cookie;
>  	struct cst816x_touch tch;
> +	unsigned int gest_idx;
>  
>  	if (!cst816x_process_touch(priv, &tch))

[Severity: High]
This is a pre-existing issue, but are stack allocated variables safely
passed to i2c_transfer() here?

The local variable `tch` is allocated on the stack and passed to
cst816x_process_touch(), which then passes it to cst816x_i2c_read_register():

drivers/input/touchscreen/hynitron-cst816x.c:cst816x_i2c_read_register() {
	struct i2c_msg xfer[] = {
		{
			.addr = priv->client->addr,
			.flags = 0,
			.buf = &reg,
			.len = sizeof(reg),
		},
		{
			.addr = priv->client->addr,
			.flags = I2C_M_RD,
			.buf = buf,
			.len = len,
		},
	};
	...
	ret = i2c_transfer(priv->client->adapter, xfer, ARRAY_SIZE(xfer));
	...
}

Because stack memory can be mapped in virtual memory (VMAP_STACK), it is
not guaranteed to be physically contiguous or DMA-safe.

If the underlying I2C adapter uses DMA, passing `&reg` or `buf` (pointing
to `tch`) could cause a kernel panic or silent memory corruption.

>  		return IRQ_HANDLED;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260815021821.2896-1-m13940358460@163.com?part=1

Re: [PATCH] Input: touch screen - cst816x: fix gesture handling

[Oleh Kuzhylnyi]

On Sat, 15 Aug 2026 02:18:21 +0800, Jianing Li wrote:

> The controller reports 0x05 for single click and 0x0b for double
> click, while the binding only defines keycode mappings for the four
> swipe gestures and long press. cst816x_gest_idx() currently maps every
> other nonzero gesture to the long-press slot, so unsupported gesture
> IDs can be reported using the long-press keycode.

Officially, the driver and DT bindings do not configure or support the
Double Click (0x0b) gesture. While the hardware may support it, the driver
does not enable or map it.

We shouldn't handle gestures outside of those documented in the DT
bindings, unless the goal is specifically to ignore noise on the I2C bus.

I re-tested the original driver on physical hardware (Raspberry Pi 4b with a
CST816S display module) with debug logs enabled, and I confirmed that no
gesture codes outside of those defined in the DT bindings are emitted.

Best Regards,
Oleh