Re: [PATCH v2] Input: hynitron_cstxxx: validate touch count and finger IDs

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The driver passes stack-allocated buffers directly to I2C transfer functions, which violates DMA mapping rules and can cause kernel panics or data corruption.
--

--- Patch [1]: [PATCH v2] Input: hynitron_cstxxx: validate touch count and finger IDs ---
commit cf5d1ec7af0f8cb9ee23a1f75f59f7e64afb8fe7
Author: Jianing Li <m13940358460@163.com>

Input: hynitron_cstxxx: validate touch count and finger IDs

This commit adds bounds checking for the touch count and finger ID read
from the controller. It ensures that neither exceeds max_touch_num,
preventing out-of-bounds slot accesses during input reporting.

> diff --git a/drivers/input/touchscreen/hynitron_cstxxx.c b/drivers/input/touchscreen/hynitron_cstxxx.c
> index f6139b1a86811..5f2737fe99026 100644
> --- a/drivers/input/touchscreen/hynitron_cstxxx.c
> +++ b/drivers/input/touchscreen/hynitron_cstxxx.c
> @@ -312,6 +312,11 @@ static void cst3xx_touch_report(struct i2c_client *client)
>  		return;
>  
>  	touch_cnt = buf[5] & CST3XX_TOUCH_COUNT_MASK;

[Severity: High]
This is a pre-existing issue, but I noticed that buf is a stack-allocated
array in cst3xx_touch_report() that is passed to i2c_transfer() via
cst3xx_i2c_read_register() earlier in the function.

If the I2C host controller maps the buffers for DMA, passing a stack-allocated
buffer can lead to memory corruption, kernel panics, or DMA API debug warnings
because stack memory is not DMA-safe (especially with virtual kernel stacks
enabled).

Looking at the rest of drivers/input/touchscreen/hynitron_cstxxx.c, similar
stack allocations occur in other functions:

cst3xx_i2c_read_register() allocates __le16 buf
cst3xx_firmware_info() allocates unsigned char buf[4]
cst3xx_bootloader_enter() allocates unsigned char buf[3]
cst3xx_finish_touch_read() allocates unsigned char buf[3]

Should these buffers be heap-allocated or moved to a DMA-safe allocation
within the device structure to prevent DMA corruption?

> +	if (touch_cnt > ts_data->chip->max_touch_num) {
> +		dev_err(&client->dev, "cst3xx touch read failure\n");
> +		return;
> +	}
> +
>  	/*
>  	 * Check the check bit of the last touch slot. The check bit is
>  	 * always present after touch point 1 for valid data, and then
[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260804031339.2379-1-m13940358460@163.com?part=1