Re: [PATCH] Input: hynitron_cstxxx: reject out-of-range finger IDs

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing bounds check on `touch_cnt` leads to out-of-bounds stack memory reads.
--

--- Patch [1]: [PATCH] Input: hynitron_cstxxx: reject out-of-range finger IDs ---
commit 91e0c941ddcc6d0f4ff8d05bd12420502e2416a4
Author: Jianing Li <m13940358460@163.com>

Input: hynitron_cstxxx: reject out-of-range finger IDs

The driver allocates max_touch_num input slots, which are indexed from
zero through max_touch_num - 1. This commit fixes an out-of-bounds access
by rejecting finger IDs that are greater than or equal to max_touch_num
before using them as slot indexes.

> diff --git a/drivers/input/touchscreen/hynitron_cstxxx.c b/drivers/input/touchscreen/hynitron_cstxxx.c
> index f6139b1a86811..05e877b0d8776 100644
> --- a/drivers/input/touchscreen/hynitron_cstxxx.c
> +++ b/drivers/input/touchscreen/hynitron_cstxxx.c
> @@ -334,7 +334,7 @@ static void cst3xx_touch_report(struct i2c_client *client)
>  		finger_id = (buf[idx] >> 4) & 0x0f;
>  
>  		/* Sanity check we don't have more fingers than we expect */
> -		if (ts_data->chip->max_touch_num < finger_id) {
> +		if (finger_id >= ts_data->chip->max_touch_num) {

[Severity: High]
This is a pre-existing issue, but while we are checking for out-of-range
values in cst3xx_touch_report(), is there a missing bounds check on
touch_cnt earlier in this function?

The touch_cnt is extracted from the 28-byte fixed-size buf array:

    touch_cnt = buf[5] & CST3XX_TOUCH_COUNT_MASK;

If the device returns a touch_cnt greater than 5, wouldn't the end_byte
calculation result in an out-of-bounds stack memory read when checking the
last touch slot?

    if (touch_cnt > 1) {
            end_byte = touch_cnt * 5 + 2;
            if (buf[end_byte] != CST3XX_TOUCH_DATA_CHK_VAL) {

For example, a touch_cnt of 6 or more would evaluate to an end_byte of 32
or greater, reading past the end of the 28-byte buf array. Similarly, the
subsequent coordinate extraction loop would also sequentially read past the
end of buf.

Can this out-of-bounds read occur if the device firmware malfunctions or
returns an unexpectedly large touch count?

>  			dev_err(&client->dev, "cst3xx touch read failure\n");
>  			break;
>  		}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260804020314.2082-1-m13940358460@163.com?part=1