Re: [PATCH v4 1/2] Input: synaptics-rmi4 - fix irq[] overrun with 7 interrupt sources

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Out-of-bounds slab write in F11 and F12 probe functions due to an unconditional assumption that the device declared at least 2 interrupts.
--

--- Patch [1]: [PATCH v4 1/2] Input: synaptics-rmi4 - fix irq[] overrun with 7 interrupt sources ---
commit 6aea384b7eaeeddd41195e537ea461a05594e8d1
Author: Wei Jie Law <98lawweijie@gmail.com>

Input: synaptics-rmi4 - fix irq[] overrun with 7 interrupt sources

This commit increases RMI_FN_MAX_IRQS from 6 to 7 to match the
RMI_PDT_INT_SOURCE_COUNT_MASK. This prevents an out-of-bounds array access
when a device declares 7 interrupt sources.

> diff --git a/drivers/input/rmi4/rmi_bus.h b/drivers/input/rmi4/rmi_bus.h
> index 90122df21f746..faf2ebb00d521 100644
> --- a/drivers/input/rmi4/rmi_bus.h
> +++ b/drivers/input/rmi4/rmi_bus.h
> @@ -12,10 +12,13 @@
>  struct rmi_device;
>  
>  /*
> - * The interrupt source count in the function descriptor can represent up to
> - * 6 interrupt sources in the normal manner.
> + * The interrupt source count in the function descriptor is a three bit field
> + * (RMI_PDT_INT_SOURCE_COUNT_MASK), so a device can legitimately declare up to
> + * 7 interrupt sources for a single function.  irq[] must be able to hold all
> + * of them: rmi_create_function_irq() and rmi_unregister_function() both walk
> + * it up to fn->num_of_irqs.
>   */
> -#define RMI_FN_MAX_IRQS	6
> +#define RMI_FN_MAX_IRQS	7

[Severity: High]
This isn't a bug introduced by this patch, but can the unconditional setting
of fn->irq_pos + 1 in the F11 and F12 drivers lead to a slab out-of-bounds
write?

If a malicious or emulated device provides a Page Description Table where the
total sum of interrupt_source_count across all functions is an exact multiple
of BITS_PER_LONG (e.g., 64), and an F11 or F12 function is placed at the end
with only 1 interrupt declared:

In drivers/input/rmi4/rmi_f11.c:rmi_f11_initialize():
    set_bit(fn->irq_pos + 1, f11->rel_mask);

In drivers/input/rmi4/rmi_f12.c:rmi_f12_probe():
    set_bit(fn->irq_pos + 1, f12->irq_mask + irq_mask_size);

Since mask_size is calculated as BITS_TO_LONGS(64), it allocates exactly 1
unsigned long (8 bytes). With fn->irq_pos = 63, set_bit(64, mask) will
attempt to modify mask[1], writing 8 bytes past the end of the devm_kzalloc
buffer.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260825103123.12216-1-98lawweijie@gmail.com?part=1