Re: [PATCH v2] Input: tca8418_keypad - Add devm cleanup to disable interrupts on unload

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing bounds check on hardware-provided scan code leads to an out-of-bounds read on the keymap array.
--

commit a7ecc5efa5741df5c7a115258a1df26344bc93c3
Author: Zhian Liang <liangzhan5dev@gmail.com>

Input: tca8418_keypad - Add devm cleanup to disable interrupts on unload

This patch adds a devm action during probe to clear the CFG register and
interrupt status when the device is released. This ensures interrupts are
properly disabled on probe failure and driver unbind.

> diff --git a/drivers/input/keyboard/tca8418_keypad.c b/drivers/input/keyboard/tca8418_keypad.c
> index 4616afa0286c3..a7c7e23f16617 100644
> --- a/drivers/input/keyboard/tca8418_keypad.c
> +++ b/drivers/input/keyboard/tca8418_keypad.c

[ ... ]

While reviewing this patch, I noticed a pre-existing issue in the event
handling path:

drivers/input/keyboard/tca8418_keypad.c:tca8418_read_keypad() {
    ...
		code = MATRIX_SCAN_CODE(row, col, keypad_data->row_shift);
		input_event(input, EV_MSC, MSC_SCAN, code);
		input_report_key(input, keymap[code], state);
    ...
}

[Severity: High]
This isn't a bug introduced by this patch, but pre-existed in the codebase.

Does this code lack a bounds check on the hardware-provided scan code?

If a malfunctioning or maliciously crafted I2C device returns a large row
or column value, it appears the computed code index could exceed the
allocated keymap size. Using this index directly in input_report_key()
might lead to an out-of-bounds read on the dynamically allocated keymap
array, potentially causing a kernel panic or leaking adjacent kernel memory.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260903210639.22472-1-liangzhan5dev@gmail.com?part=1