Re: [PATCH 01/10] Input: synaptics-rmi4 - fix F55 transmitter electrode count typo

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Medium] F55:Ctrl2 register array is read from an incorrect static offset, causing overlapping reads with the preceding F55:Ctrl1 register array.
--

commit b444f8759d3d03dbb87e0c3fd33dd8bdd2ff2bcf
Author: Dmitry Torokhov <dmitry.torokhov@gmail.com>

    Input: synaptics-rmi4 - fix F55 transmitter electrode count typo

    This commit fixes a typo during F55 sensor detection where the transmitter
    electrode count was incorrectly assigned the value of the receiver electrode
    count. The incorrect value was then propagated to the driver data and
    inflated the perceived TX count for F54, potentially leading to
    out-of-bounds buffer accesses.

> diff --git a/drivers/input/rmi4/rmi_f55.c b/drivers/input/rmi4/rmi_f55.c
> index 488adaca4dd00..a0877d32a9141 100644
> --- a/drivers/input/rmi4/rmi_f55.c
> +++ b/drivers/input/rmi4/rmi_f55.c
> @@ -54,10 +54,10 @@ static int rmi_f55_detect(struct rmi_function *fn)
>  	f55->num_tx_electrodes = f55->qry[F55_NUM_TX_OFFSET];
>  
>  	f55->cfg_num_rx_electrodes = f55->num_rx_electrodes;
> -	f55->cfg_num_tx_electrodes = f55->num_rx_electrodes;
> +	f55->cfg_num_tx_electrodes = f55->num_tx_electrodes;
>  
>  	drv_data->num_rx_electrodes = f55->cfg_num_rx_electrodes;
> -	drv_data->num_tx_electrodes = f55->cfg_num_rx_electrodes;
> +	drv_data->num_tx_electrodes = f55->cfg_num_tx_electrodes;
>  
>  	if (f55->qry[F55_PHYS_CHAR_OFFSET] & F55_CAP_SENSOR_ASSIGN) {
>  		int i, total;

[Severity: Medium]
This is a pre-existing issue, but I have a question about the offset used when
reading the F55:Ctrl2 register array.

Just below this hunk in rmi_f55_detect(), the code reads the transmitter
assignment array using a hardcoded +2 offset:

drivers/input/rmi4/rmi_f55.c:rmi_f55_detect() {
    ...
		error = rmi_read_block(fn->rmi_dev,
				       fn->fd.control_base_addr + 1,
				       buf, f55->num_rx_electrodes);
    ...
		error = rmi_read_block(fn->rmi_dev,
				       fn->fd.control_base_addr + 2,
				       buf, f55->num_tx_electrodes);
    ...
}

Will using a hardcoded +2 offset for Ctrl2 cause it to overlap with the Ctrl1
array if num_rx_electrodes > 1, or skip a byte if num_rx_electrodes == 0?

Should the offset dynamically account for the size of Ctrl1, such as using
control_base_addr + 1 + f55->num_rx_electrodes?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260626051802.4033172-1-dmitry.torokhov@gmail.com?part=1