Re: [PATCH v2 8/9] dt-bindings: input: microchip,cap11xx: Add CAP1114 support

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] Schema constraint conflict for `linux,keycodes` makes CAP1114 validation impossible.
- [High] Buffer overflow when parsing `microchip,calib-sensitivity` property for models with >8 channels.
--

commit f0d8405d987f3f3e2623cf6af9274da6bb531e55
Author: Jun Yan <jerrysteve1101@gmail.com>

    dt-bindings: input: microchip,cap11xx: Add CAP1114 support
    
    CAP1114 is a 14-channel capacitive touch sensor with 11 LED outputs
    and hardware reset support. Add the compatible string for CAP1114,
    update maximum LED channels, and add constraints for linux,keycodes.

> diff --git a/Documentation/devicetree/bindings/input/microchip,cap11xx.yaml b/Documentation/devicetree/bindings/input/microchip,cap11xx.yaml
> index 778ec6d659a8d..0e9a1a8a3f3e7 100644
> --- a/Documentation/devicetree/bindings/input/microchip,cap11xx.yaml
> +++ b/Documentation/devicetree/bindings/input/microchip,cap11xx.yaml

[ ... ]

> @@ -178,6 +182,18 @@ allOf:
>        properties:
>          reset-gpios: false
>  
> +  - if:
> +      properties:
> +        compatible:
> +          contains:
> +            enum:
> +              - microchip,cap1114
> +    then:
> +      properties:
> +        linux,keycodes:
> +          minItems: 14
> +          maxItems: 14
> +

[Severity: High]
This conditional block enforces 14 items for linux,keycodes, but earlier in
the file there is a global constraint that limits it to 8:

  linux,keycodes:
    minItems: 3
    maxItems: 8

Because JSON Schema evaluates global and conditional constraints cumulatively,
any valid CAP1114 node with 14 keycodes will fail dt_binding_check against
the global 8-item limit. Should the global maxItems be increased to 14,
while keeping other models constrained in their respective blocks?

[ ... ]

One additional question regarding the CAP1114 integration with the driver:

[Severity: High]
When CAP1114 support is added to the driver (since num_channels will be 14),
can this lead to an out-of-bounds write?

In drivers/input/keyboard/cap11xx.c, calib_sensitivities is a fixed-size
8-element array:

	struct cap11xx_priv {
		...
		u32 calib_sensitivities[8];
		u32 keycodes[];
	};

However, during initialization, the driver reads num_channels items into it:

	if (!of_property_read_u32_array(node, "microchip,calib-sensitivity",
					priv->calib_sensitivities,
					priv->model->num_channels)) {

Even though the CAP1114 binding forbids microchip,calib-sensitivity, an
incorrectly configured or malicious device tree providing 14 items could
cause this to overflow the 8-element array by 24 bytes. Does the driver
need to be updated to prevent this when num_channels is greater than 8?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260612072237.1177304-1-jerrysteve1101@gmail.com?part=8