* [PATCH] Input: ti_am335x_tsc: fix off-by-one error in wire_order validation
@ 2025-11-14 6:28 Junjie Cao
2025-12-01 6:02 ` Junjie Cao
0 siblings, 1 reply; 2+ messages in thread
From: Junjie Cao @ 2025-11-14 6:28 UTC (permalink / raw)
To: dmitry.torokhov; +Cc: linux-input, linux-kernel, junjie.cao
The current validation 'wire_order[i] > ARRAY_SIZE(config_pins)' allows
wire_order[i] to equal ARRAY_SIZE(config_pins), which causes out-of-bounds
access when used as index in 'config_pins[wire_order[i]]'.
Since config_pins has 4 elements (indices 0-3), the valid range for
wire_order should be 0-3. Fix the off-by-one error by using >= instead
of > in the validation check.
Signed-off-by: Junjie Cao <junjie.cao@intel.com>
---
drivers/input/touchscreen/ti_am335x_tsc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/input/touchscreen/ti_am335x_tsc.c b/drivers/input/touchscreen/ti_am335x_tsc.c
index 93d659ff90aa..73980142f492 100644
--- a/drivers/input/touchscreen/ti_am335x_tsc.c
+++ b/drivers/input/touchscreen/ti_am335x_tsc.c
@@ -85,7 +85,7 @@ static int titsc_config_wires(struct titsc *ts_dev)
wire_order[i] = ts_dev->config_inp[i] & 0x0F;
if (WARN_ON(analog_line[i] > 7))
return -EINVAL;
- if (WARN_ON(wire_order[i] > ARRAY_SIZE(config_pins)))
+ if (WARN_ON(wire_order[i] >= ARRAY_SIZE(config_pins)))
return -EINVAL;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] Input: ti_am335x_tsc: fix off-by-one error in wire_order validation
2025-11-14 6:28 [PATCH] Input: ti_am335x_tsc: fix off-by-one error in wire_order validation Junjie Cao
@ 2025-12-01 6:02 ` Junjie Cao
0 siblings, 0 replies; 2+ messages in thread
From: Junjie Cao @ 2025-12-01 6:02 UTC (permalink / raw)
To: Dmitry Torokhov; +Cc: linux-input, linux-kernel
Hi Dmitry,
Just a gentle ping on this patch~
Best regards,
Junjie
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2025-12-01 6:04 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-11-14 6:28 [PATCH] Input: ti_am335x_tsc: fix off-by-one error in wire_order validation Junjie Cao
2025-12-01 6:02 ` Junjie Cao
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).