Re: [PATCH v2 1/2] Input: synaptics-rmi4 - fix irq[] overrun with 7 interrupt sources

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing error check for `irq_create_mapping()` return value.
--

--- Patch [1]: [PATCH v2 1/2] Input: synaptics-rmi4 - fix irq[] overrun with 7 interrupt sources ---
commit 8ffaede8e39380dc2ce433141763af42eefb7d4a
Author: Wei Jie Law <98lawweijie@gmail.com>

Input: synaptics-rmi4 - fix irq[] overrun with 7 interrupt sources

The commit fixes an out-of-bounds array access in the rmi4 driver by
increasing RMI_FN_MAX_IRQS from 6 to 7. A device can legitimately declare
up to 7 interrupt sources, causing the driver to overwrite memory when
indexing the irq array.

> diff --git a/drivers/input/rmi4/rmi_bus.h b/drivers/input/rmi4/rmi_bus.h
> index 90122df21f746..faf2ebb00d521 100644
> --- a/drivers/input/rmi4/rmi_bus.h
> +++ b/drivers/input/rmi4/rmi_bus.h
> @@ -12,10 +12,13 @@

[ ... ]

> -#define RMI_FN_MAX_IRQS	6
> +#define RMI_FN_MAX_IRQS	7

[Severity: High]
This isn't a bug introduced by this patch, but I noticed a potential problem
in how the interrupts are mapped in rmi_create_function_irq().

drivers/input/rmi4/rmi_bus.c:rmi_create_function_irq() {
        ...
        fn->irq[i] = irq_create_mapping(drvdata->irqdomain,
                                        fn->irq_pos + i);

        irq_set_chip_data(fn->irq[i], fn);
        irq_set_chip_and_handler(fn->irq[i], &rmi_irq_chip,
                                 handle_simple_irq);
        ...
}

Does this code need to check if irq_create_mapping() returns 0?

If memory allocation fails or the IRQ domain is exhausted during device probe,
it seems we might pass 0 directly to irq_set_chip_data() and
irq_set_chip_and_handler().

On architectures where IRQ 0 is a valid and critical system interrupt, like
the x86 system timer, could overwriting the descriptor cause system
instability?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260824122733.76321-1-98lawweijie@gmail.com?part=1