Re: [PATCH 3/4] Input: hynitron-cst816x: release gesture keys

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] input: OOB read in cst816x_release_keys() due to unvalidated DT keycodes
--

commit cb8390c95078c2f0098d2be4f937c758b29ad76d
Author: Daniel Golle <daniel@makrotopia.org>

Input: hynitron-cst816x: release gesture keys

The gesture key is reported with the value of the touch flag, so it stays
pressed once the controller stops reporting the gesture code while the
finger is still down. This commit reports the press on its own and releases
the keys the input core still holds down when the first report without a
gesture code arrives.

> diff --git a/drivers/input/touchscreen/hynitron-cst816x.c b/drivers/input/touchscreen/hynitron-cst816x.c
> index 865c5a767ba01..e2093518e8af1 100644
> --- a/drivers/input/touchscreen/hynitron-cst816x.c
> +++ b/drivers/input/touchscreen/hynitron-cst816x.c
[ ... ]
> @@ -168,6 +168,18 @@ static void cst816x_reset(struct cst816x_priv *priv)
>  	msleep(100);
>  }
>  
> +static void cst816x_release_keys(struct cst816x_priv *priv)
> +{
> +	unsigned int i;
> +
> +	for (i = 0; i < priv->keycodemax; i++) {
> +		if (!test_bit(priv->keycode[i], priv->input->key))

[Severity: Medium]
Can this read out of bounds on the priv->input->key bitmap?

If a keycode provided in the device tree property exceeds KEY_MAX,
input_set_capability() safely ignores it during registration, but the
invalid large value remains in the priv->keycode array.

When cst816x_release_keys() iterates over this array, it directly calls
test_bit(priv->keycode[i], priv->input->key). Since test_bit() doesn't
perform bounds checking like the input core's event handlers do, passing
an oversized keycode could result in a memory read past the end of the
bitmap structure during touch interrupts.

> +			continue;
> +
> +		input_report_key(priv->input, priv->keycode[i], 0);
> +	}
> +}
> +

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/d18629ede3f2fd5a08d0cbdaf82f4254e89500ed.1790851590.git.daniel@makrotopia.org?part=3