[PATCH] Input: hynitron_cstxxx - validate touch count against buffer

[PATCH] Input: hynitron_cstxxx - validate touch count against buffer

[Pengpeng Hou]

cst3xx_touch_report() uses the device-reported touch count to compute
the check-byte offset and to parse touch slots in a fixed 28-byte
buffer.

Bound the touch count against the chip limit and the buffer layout
before parsing.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
 drivers/input/touchscreen/hynitron_cstxxx.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/input/touchscreen/hynitron_cstxxx.c b/drivers/input/touchscreen/hynitron_cstxxx.c
index 1d8ca90..6644272 100644
--- a/drivers/input/touchscreen/hynitron_cstxxx.c
+++ b/drivers/input/touchscreen/hynitron_cstxxx.c
@@ -313,6 +313,12 @@ static void cst3xx_touch_report(struct i2c_client *client)
 		return;
 
 	touch_cnt = buf[5] & CST3XX_TOUCH_COUNT_MASK;
+	if (touch_cnt > ts_data->chip->max_touch_num ||
+	    (touch_cnt > 1 && touch_cnt * 5 + 2 >= sizeof(buf))) {
+		dev_err(&client->dev, "cst3xx touch read failure\n");
+		return;
+	}
+
 	/*
 	 * Check the check bit of the last touch slot. The check bit is
 	 * always present after touch point 1 for valid data, and then

Re: [PATCH] Input: hynitron_cstxxx - validate touch count against buffer

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The driver passes stack-allocated memory to `i2c_transfer()` and `i2c_master_send()`, which can cause memory corruption or system crashes if the underlying I2C controller uses DMA.
--

commit c00eb5cc820dacf72d27095570836d29b4df9d2d
Author: Pengpeng Hou <pengpeng@iscas.ac.cn>

Input: hynitron_cstxxx - validate touch count against buffer

Bounds the device-reported touch count against the chip limit and buffer
layout before parsing touch slots.

> diff --git a/drivers/input/touchscreen/hynitron_cstxxx.c b/drivers/input/touchscreen/hynitron_cstxxx.c
> index 1d8ca90dcda69..6644272bc72a4 100644
> --- a/drivers/input/touchscreen/hynitron_cstxxx.c
> +++ b/drivers/input/touchscreen/hynitron_cstxxx.c
> @@ -313,6 +313,12 @@ static void cst3xx_touch_report(struct i2c_client *client)
>  		return;
>  
>  	touch_cnt = buf[5] & CST3XX_TOUCH_COUNT_MASK;

[Severity: High]
This isn't a bug introduced by this patch, but is it safe to use
stack-allocated memory for I2C transfers?

Looking at cst3xx_touch_report(), buf is allocated on the stack and passed
down to cst3xx_i2c_read_register():

drivers/input/touchscreen/hynitron_cstxxx.c:cst3xx_touch_report() {
        ...
        u8 buf[28];
        ...
        err = cst3xx_i2c_read_register(client, CST3XX_TOUCH_DATA_PART_REG,
                                       buf, 28);
        ...
}

The cst3xx_i2c_read_register() function also appears to allocate its register
address buffer on the stack:

drivers/input/touchscreen/hynitron_cstxxx.c:cst3xx_i2c_read_register() {
        ...
        __le16 buf = cpu_to_le16(reg);
        ...
                .buf = (u8 *)&buf,
        ...
}

If the underlying I2C adapter driver uses DMA to perform the transfer, mapping
stack memory for DMA can cause cache coherency issues, memory corruption, or
kernel panics, particularly when CONFIG_VMAP_STACK is enabled.

> +	if (touch_cnt > ts_data->chip->max_touch_num ||
> +	    (touch_cnt > 1 && touch_cnt * 5 + 2 >= sizeof(buf))) {
> +		dev_err(&client->dev, "cst3xx touch read failure\n");
> +		return;
> +	}
> +
>  	/*
>  	 * Check the check bit of the last touch slot. The check bit is
>  	 * always present after touch point 1 for valid data, and then

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/2026063009041899.4-ccfa108-0047-Input-hynitron_cstxxx---val-pengpeng@iscas.ac.cn?part=1