mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-08-31 01:11:51 -04:00
Code Issues Packages Projects Releases Wiki Activity

Input: cap11xx - guard unsupported DT properties before parsing

Browse Source 
Check of_property_present() before parsing microchip,calib-sensitivity
and microchip,signal-guard, so that models which do not support these
properties (e.g. CAP1114) skip the parsing entirely.

This prevents a potential buffer overflow in calib_sensitivities[8] and
signal_guard_inputs_mask when a model with more than 8 channels
(CAP1114 has 14) would otherwise call of_property_read_u32_array()
with num_channels as the element count.

Signed-off-by: Jun Yan <jerrysteve1101@gmail.com>
Link: https://patch.msgid.link/20260617150318.753148-9-jerrysteve1101@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
This commit is contained in:
Jun Yan
2026-06-17 23:02:47 +08:00
committed by Dmitry Torokhov
parent 6ddb3d0c90
commit a9a7baeb3a
1 changed files with 27 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files

52
drivers/input/keyboard/cap11xx.c
View File

@@ -233,10 +233,13 @@ static int cap11xx_init_keys(struct cap11xx_priv *priv)
}
}
if (!of_property_read_u32_array(node, "microchip,calib-sensitivity",
priv->calib_sensitivities,
priv->model->num_channels)) {
if (priv->model->has_sensitivity_control) {
if (of_property_present(node, "microchip,calib-sensitivity")) {
if (!priv->model->has_sensitivity_control) {
dev_warn(dev,
"This model doesn't support 'calib-sensitivity'\n");
} else if (!of_property_read_u32_array(node, "microchip,calib-sensitivity",
priv->calib_sensitivities,
priv->model->num_channels)) {
for (i = 0; i < priv->model->num_channels; i++) {
if (!is_power_of_2(priv->calib_sensitivities[i]) ||
priv->calib_sensitivities[i] > 4) {
@@ -256,32 +259,31 @@ static int cap11xx_init_keys(struct cap11xx_priv *priv)
if (error)
return error;
}
} else {
dev_warn(dev,
"This model doesn't support 'calib-sensitivity'\n");
}
}
for (i = 0; i < priv->model->num_channels; i++) {
if (!of_property_read_u32_index(node, "microchip,signal-guard",
i, &u32_val)) {
if (u32_val > 1)
return -EINVAL;
if (u32_val)
priv->signal_guard_inputs_mask |= 0x01 << i;
}
}
if (priv->signal_guard_inputs_mask) {
if (priv->model->has_signal_guard) {
error = regmap_write(priv->regmap,
CAP11XX_REG_SIGNAL_GUARD_ENABLE,
priv->signal_guard_inputs_mask);
if (error)
return error;
} else {
if (of_property_present(node, "microchip,signal-guard")) {
if (!priv->model->has_signal_guard) {
dev_warn(dev,
"This model doesn't support 'signal-guard'\n");
} else {
for (i = 0; i < priv->model->num_channels; i++) {
if (!of_property_read_u32_index(node, "microchip,signal-guard",
i, &u32_val)) {
if (u32_val > 1)
return -EINVAL;
if (u32_val)
priv->signal_guard_inputs_mask |= 0x01 << i;
}
}
if (priv->signal_guard_inputs_mask) {
error = regmap_write(priv->regmap,
CAP11XX_REG_SIGNAL_GUARD_ENABLE,
priv->signal_guard_inputs_mask);
if (error)
return error;
}
}
}