Re: [PATCH v7 4/4] Input: Add TouchNetix aXiom I2C Touchscreen support

[Dmitry Torokhov <dmitry.torokhov@gmail.com>]

On Thu, Jul 02, 2026 at 10:48:04PM +0000, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 18 potential issue(s) to consider:
> - [High] Missing bounds checking during firmware chunk parsing allows malformed firmware to trigger integer underflow and out-of-bounds memory accesses.
> - [High] Invalid cast of regmap buffer to u16* causes endian-dependent behavior and corrupts register addresses.
> - [High] Unbalanced pm_runtime_put in firmware upload cleanup leads to negative PM usage counts.
> - [High] Firmware-controlled allocation size allows out-of-bounds heap read when checking touch slots.
> - [High] The driver prevents firmware recovery when the device boots in bootloader mode by improperly failing the probe.
> - [High] fwupdate_lock is held across system calls violating kernel mutex semantics, and is double-unlocked on error paths.
> - [High] Improper devm teardown order causes Use-After-Free of the input device by background firmware upload threads.

I am not sure this is true as sysfs attributes should be removed iand
handlers complete before we get to remove() method. 

> - [High] Use-after-free of ts->input in the threaded IRQ handler during config firmware updates and device removal.
> - [High] The driver waits on completion primitives for hardware resets and saves without reinitializing them, causing future waits to falsely succeed immediately.
> - [High] The driver passes stack-allocated buffers to I2C transfers, which violates DMA requirements and can cause memory corruption.

This is Sashiko's hallucination.

> - [High] NULL pointer dereference in `axiom_remove_axfw_fwl_action` if `devm_add_action_or_reset` fails.
> - [Medium] An operator precedence error in subtracting the preamble and postamble causes the calculated report payload length to be artificially inflated.
> - [Medium] Probe error paths leak PM runtime references and fail to disable regulators.
> - [Medium] I2C read errors are swallowed and falsely reported as success in polling functions.
> - [Medium] Missing NULL check on `kasprintf` results in a crash or broken sysfs state when registering the firmware upload interfaces.
> - [Medium] The driver lacks system sleep power management callbacks, causing the device to remain powered on during system suspend if not acting as a panel follower.
> - [Medium] Dead code in `axiom_register_input_dev` prevents failing initialization when no touchslots are enabled.
> - [Low] Typo in the sysfs `device_state` output violates the documented ABI.
> --

However there appears to be quite a few items that need addressing.

Thanks.

-- 
Dmitry