Pengpeng Hou 0aa7c205e9 Input: iqs5xx - validate firmware record destination span ...

The firmware record parser checks that the record address starts within
the programmable map, but does not check that the complete record data
fits in that map. A record near the end of the map can therefore make
the copy to pmap exceed its destination span.

Check the record length against the remaining programmable map range
before copying the record data.

Fixes: 7b5bb55d0d ("Input: add support for Azoteq IQS550/572/525")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260715083850.32155-1-pengpeng@iscas.ac.cn
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

2026-07-24 18:18:47 -07:00

..

88pm860x-ts.c

Input: 88pm860x - use cleanup facility for device_node

2024-10-19 21:21:41 -07:00

ad7877.c

Input: ad7877 - use guard notation when acquiring mutexes/locks

2026-03-24 21:14:18 -07:00

ad7879-i2c.c

Input: Use named initializers for arrays of i2c_device_data

2026-05-30 22:10:47 -07:00

ad7879-spi.c

Input: ad7879 - use device core to create driver-specific device attributes

2023-09-06 14:23:47 -07:00

ad7879.c

Input: ad7879 - use guard notation when acquiring mutexes

2026-03-24 21:14:19 -07:00

ad7879.h

Input: ad7879 - use device core to create driver-specific device attributes

2023-09-06 14:23:47 -07:00

ads7846.c

Input: ads7846 - don't use scratch for tx_buf when clearing register

2026-06-10 15:47:47 -07:00

apple_z2.c

Input: apple_z2 - fix reading incorrect reports after exiting sleep

2025-12-18 12:17:10 -08:00

ar1021_i2c.c

Input: Use named initializers for arrays of i2c_device_data

2026-05-30 22:10:47 -07:00

atmel_mxt_ts.c

Merge tag 'v7.1-rc6' into next

2026-05-31 19:43:25 -07:00

auo-pixcir-ts.c

Input: Use named initializers for arrays of i2c_device_data

2026-05-30 22:10:47 -07:00

bcm_iproc_tsc.c

input: Fix typos in comments across various files

2024-09-30 07:58:33 -07:00

bu21013_ts.c

Input: Use named initializers for arrays of i2c_device_data

2026-05-30 22:10:47 -07:00

bu21029_ts.c

Input: Use named initializers for arrays of i2c_device_data

2026-05-30 22:10:47 -07:00

chipone_icn8318.c

Input: chipone_icn8318 - use guard notation when acquiring mutex

2026-03-24 21:14:22 -07:00

chipone_icn8505.c

move asm/unaligned.h to linux/unaligned.h

2024-10-02 17:23:23 -04:00

colibri-vf50-ts.c

Input: colibri-vf50-ts - make use of the helper function dev_err_probe()

2024-08-19 10:22:56 -07:00

cy8ctma140.c

Input: Use named initializers for arrays of i2c_device_data

2026-05-30 22:10:47 -07:00

cy8ctmg110_ts.c

Input: Use named initializers for arrays of i2c_device_data

2026-05-30 22:10:47 -07:00

cyttsp5.c

Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)

2026-07-03 07:38:17 +02:00

cyttsp_core.c

Input: cyttsp - use guard notation when acquiring mutex

2026-03-24 21:14:23 -07:00

cyttsp_core.h

Input: cyttsp4 - remove driver

2024-08-05 10:48:49 -07:00

cyttsp_i2c.c

Input: Use named initializers for arrays of i2c_device_data

2026-05-30 22:10:47 -07:00

cyttsp_spi.c

Input: cyttsp - use EXPORT_GPL_SIMPLE_DEV_PM_OPS()

2023-01-27 14:49:53 -08:00

da9034-ts.c

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500

2019-06-19 17:09:55 +02:00

da9052_tsi.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

dynapro.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

edt-ft5x06.c

Input: edt-ft5x06 - fix use-after-free in debugfs teardown

2026-04-19 17:54:06 -07:00

eeti_ts.c

Input: Use named initializers for arrays of i2c_device_data

2026-05-30 22:10:47 -07:00

egalax_ts_serial.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

egalax_ts.c

Input: Use named initializers for arrays of i2c_device_data

2026-05-30 22:10:47 -07:00

ektf2127.c

Input: ektf2127 - use guard notation when acquiring mutex

2026-03-24 21:14:24 -07:00

elants_i2c.c

Input: Use named initializers for arrays of i2c_device_data

2026-05-30 22:10:47 -07:00

elo.c

Input: elo - use guard notation when acquiring mutex

2026-03-24 21:14:26 -07:00

exc3000.c

Input: Use named initializers for arrays of i2c_device_data

2026-05-30 22:10:47 -07:00

fsl-imx25-tcq.c

Input: remove unneeded 'fast_io' parameter in regmap_config

2025-08-21 12:00:59 -07:00

fujitsu_ts.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

goodix_berlin_core.c

Input: goodix-berlin - report a resolution of 10 units/mm

2026-03-25 09:08:17 -07:00

goodix_berlin_i2c.c

Input: goodix_berlin - add support for Berlin-A series

2025-03-10 10:46:08 -07:00

goodix_berlin_spi.c

Input: goodix_berlin - add support for Berlin-A series

2025-03-10 10:46:08 -07:00

goodix_berlin.h

Input: goodix_berlin - add support for Berlin-A series

2025-03-10 10:46:08 -07:00

goodix_fwupload.c

Input: goodix - switch to using cleanup functions in firmware code

2026-03-24 21:14:27 -07:00

goodix.c

Input: goodix - clamp the device-reported contact count

2026-06-22 20:44:12 -07:00

goodix.h

Input: goodix - remove setting of RST pin to input

2025-10-13 09:35:26 -07:00

gunze.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

hampshire.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

hideep.c

Input: Use named initializers for arrays of i2c_device_data

2026-05-30 22:10:47 -07:00

himax_hx852x.c

Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)

2026-07-03 07:38:17 +02:00

himax_hx83112b.c

Input: Use named initializers for arrays of i2c_device_data

2026-05-30 22:10:47 -07:00

hp680_ts_input.c

treewide: Add SPDX license identifier for more missed files

2019-05-21 10:50:45 +02:00

htcpen.c

isa: Make the remove callback for isa drivers return void

2021-01-26 07:42:27 +01:00

hycon-hy46xx.c

Input: hycon-hy46xx - use guard notation when acquiring mutex

2026-03-24 21:14:49 -07:00

hynitron_cstxxx.c

Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)

2026-07-03 07:38:17 +02:00

hynitron-cst816x.c

Input: Use named initializers for arrays of i2c_device_data

2026-05-30 22:10:47 -07:00

ili210x.c

Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)

2026-07-03 07:38:17 +02:00

ilitek_ts_i2c.c

Input: Use named initializers for arrays of i2c_device_data

2026-05-30 22:10:47 -07:00

imagis.c

Input: imagis - use guard notation when acquiring mutex

2026-03-24 21:14:50 -07:00

imx6ul_tsc.c

Input: imx6ul_tsc - use guard notation when acquiring mutex

2026-03-24 21:14:50 -07:00

inexio.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

ipaq-micro-ts.c

Input: ipaq-micro-ts - use guard notation when acquiring mutex/spinlock

2026-03-24 21:14:51 -07:00

iqs5xx.c

Input: iqs5xx - validate firmware record destination span

2026-07-24 18:18:47 -07:00

iqs7211.c

Input: iqs7211 - use cleanup facility for fwnodes

2026-03-24 21:14:53 -07:00

jornada720_ts.c

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500

2019-06-19 17:09:55 +02:00

Kconfig

Input: Add support for Wacom W9000-series penabled touchscreens

2026-05-29 22:31:40 -07:00

lpc32xx_ts.c

Input: lpc32xx_ts - use guard notation when acquiring mutex

2026-03-24 21:14:53 -07:00

mainstone-wm97xx.c

Input: switch back to struct platform_driver::remove()

2024-10-15 11:43:25 -07:00

Makefile

Input: Add support for Wacom W9000-series penabled touchscreens

2026-05-29 22:31:40 -07:00

max11801_ts.c

Input: Use named initializers for arrays of i2c_device_data

2026-05-30 22:10:47 -07:00

mc13783_ts.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

melfas_mip4.c

Input: Use named initializers for arrays of i2c_device_data

2026-05-30 22:10:47 -07:00

migor_ts.c

Input: Use named initializers for arrays of i2c_device_data

2026-05-30 22:10:47 -07:00

mms114.c

Input: mms114 - fix Y-resolution configuration

2026-07-13 19:30:02 -07:00

msg2638.c

Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)

2026-07-03 07:38:17 +02:00

mtouch.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

mxs-lradc-ts.c

Input: mxs-lradc-ts - use guard notation when acquiring spinlock

2026-03-25 07:53:57 -07:00

novatek-nvt-ts.c

Input: Use named initializers for arrays of i2c_device_data

2026-05-30 22:10:47 -07:00

penmount.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

pixcir_i2c_ts.c

Input: Use named initializers for arrays of i2c_device_data

2026-05-30 22:10:47 -07:00

raspberrypi-ts.c

Input: raspberrypi-ts - use cleanup facility for device_node

2024-10-19 21:21:43 -07:00

raydium_i2c_ts.c

Input: Use named initializers for arrays of i2c_device_data

2026-05-30 22:10:47 -07:00

resistive-adc-touch.c

Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)

2026-07-03 07:38:17 +02:00

rohm_bu21023.c

Input: Use named initializers for arrays of i2c_device_data

2026-05-30 22:10:47 -07:00

s6sy761.c

Input: Use named initializers for arrays of i2c_device_data

2026-05-30 22:10:47 -07:00

silead.c

Input: Use named initializers for arrays of i2c_device_data

2026-05-30 22:10:47 -07:00

sis_i2c.c

Input: Use named initializers for arrays of i2c_device_data

2026-05-30 22:10:47 -07:00

st1232.c

Input: Use named initializers for arrays of i2c_device_data

2026-05-30 22:10:47 -07:00

stmfts.c

Input: Use named initializers for arrays of i2c_device_data

2026-05-30 22:10:47 -07:00

stmpe-ts.c

Input: stmpe-ts - use module alias instead of device table

2025-04-28 12:14:12 -07:00

sun4i-ts.c

Input: switch back to struct platform_driver::remove()

2024-10-15 11:43:25 -07:00

sur40.c

Input: sur40 - fix MAX_CONTACTS value based on PixelSense specification

2026-06-26 22:25:02 -07:00

surface3_spi.c

move asm/unaligned.h to linux/unaligned.h

2024-10-02 17:23:23 -04:00

sx8654.c

Input: sx8654 - use IRQF_NOAUTOEN when requesting interrupt

2026-03-25 07:53:59 -07:00

ti_am335x_tsc.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

touchit213.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

touchright.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

touchwin.c

Input: touchwin - reset the packet index on every complete packet

2026-06-14 13:58:16 -07:00

tps6507x-ts.c

Input: tps6507x-ts - remove variable loops

2022-10-24 05:18:55 -07:00

ts4800-ts.c

Input: ts4800-ts - use cleanup facility for device_node

2024-10-19 21:21:43 -07:00

tsc40.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

tsc200x-core.c

Input: include export.h in modules using EXPORT_SYMBOL*()

2025-08-21 12:00:59 -07:00

tsc200x-core.h

Input: tsc2004/5 - fix handling of VIO power supply

2024-08-04 18:10:40 -07:00

tsc2004.c

Input: Use named initializers for arrays of i2c_device_data

2026-05-30 22:10:47 -07:00

tsc2005.c

Input: tsc2004/5 - fix handling of VIO power supply

2024-08-04 18:10:40 -07:00

tsc2007_core.c

Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)

2026-07-03 07:38:17 +02:00

tsc2007_iio.c

Input: tsc2007 - use guard notation when acquiring mutexes

2026-03-25 07:53:59 -07:00

tsc2007.h

Input: tsc2007 - accept standard properties

2024-12-10 16:17:30 -08:00

usbtouchscreen.c

Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size

2026-04-26 21:00:25 -07:00

wacom_i2c.c

Input: Use named initializers for arrays of i2c_device_data

2026-05-30 22:10:47 -07:00

wacom_w8001.c

Input: wacom_w8001 - replace strlcat() with a strscpy() helper

2026-07-15 14:37:31 -07:00

wacom_w9000.c

Input: Add support for Wacom W9000-series penabled touchscreens

2026-05-29 22:31:40 -07:00

wdt87xx_i2c.c

Input: Use named initializers for arrays of i2c_device_data

2026-05-30 22:10:47 -07:00

wm97xx-core.c

Input: wm97xx - use guard notation when acquiring mutex

2026-03-25 07:54:00 -07:00

wm831x-ts.c

Input: switch back to struct platform_driver::remove()

2024-10-15 11:43:25 -07:00

wm9705.c

Input: include export.h in modules using EXPORT_SYMBOL*()

2025-08-21 12:00:59 -07:00

wm9712.c

Input: include export.h in modules using EXPORT_SYMBOL*()

2025-08-21 12:00:59 -07:00

wm9713.c

Input: include export.h in modules using EXPORT_SYMBOL*()

2025-08-21 12:00:59 -07:00

zet6223.c

Input: Use named initializers for arrays of i2c_device_data

2026-05-30 22:10:47 -07:00

zforce_ts.c

Input: Use named initializers for arrays of i2c_device_data

2026-05-30 22:10:47 -07:00

zinitix.c

Input: zinitix - use guard notation when acquiring mutex

2026-03-25 07:54:00 -07:00