mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-07-21 23:57:36 -04:00
Code Issues Packages Projects Releases Wiki Activity

Input: rmi4 - fix num_subpackets overflow in register descriptor

Browse Source 
RMI_REG_DESC_SUBPACKET_BITS is defined as 296 (37 * BITS_PER_BYTE). This
may overflow num_subpackets in struct rmi_register_desc_item which is
defined as a u8.

Fix this by changing the type of num_subpackets to u16.

Fixes: 2b6a321da9 ("Input: synaptics-rmi4 - add support for Synaptics RMI4 devices")
Cc: stable@vger.kernel.org
Assisted-by: Gemini:gemini-3.1-pro
Link: https://patch.msgid.link/20260505045952.1570713-4-dmitry.torokhov@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
This commit is contained in:
Dmitry Torokhov
2026-05-04 21:59:34 -07:00
parent a0a87e4412
commit 2b4b482d5c
2 changed files with 8 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/input/rmi4/rmi_driver.h
View File

@@ -53,7 +53,7 @@ struct pdt_entry {
struct rmi_register_desc_item {
u16 reg;
unsigned long reg_size;
u8 num_subpackets;
u16 num_subpackets;
unsigned long subpacket_map[BITS_TO_LONGS(
RMI_REG_DESC_SUBPACKET_BITS)];
};

7
drivers/input/rmi4/rmi_f12.c
View File

@@ -467,6 +467,13 @@ static int rmi_f12_probe(struct rmi_function *fn)
f12->data1 = item;
f12->data1_offset = data_offset;
data_offset += item->reg_size;
if (item->num_subpackets > 255) {
dev_err(&fn->dev, "Too many fingers declared: %d\n",
item->num_subpackets);
return -EINVAL;
}
sensor->nbr_fingers = item->num_subpackets;
sensor->report_abs = 1;
sensor->attn_size += item->reg_size;