Input: ipaq-micro-keys - add length check in micro_key_receive

The driver accesses the message payload (msg[0]) without checking if
the length is greater than zero. The parent MFD driver can produce a
payload with a length of 0, in which case msg[0] would be uninitialized
or stale.

Add a check to return early if len is less than 1.

Reported-by: sashiko-bot@kernel.org
Assisted-by: Antigravity:gemini-3.5-flash
Link: https://patch.msgid.link/aintAvTyw4CVb5hG@google.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
This commit is contained in:
Dmitry Torokhov
2026-06-10 16:02:42 -07:00
parent ed0428e928
commit ff25a3b1cd

View File

@@ -43,6 +43,9 @@ static void micro_key_receive(void *data, int len, unsigned char *msg)
struct ipaq_micro_keys *keys = data;
int key, down;
if (len < 1)
return;
down = 0x80 & msg[0];
key = 0x7f & msg[0];