* [PATCH] Input: cyttsp5 - clamp the HID report size before memcpy
@ 2026-09-01 12:26 Linkai Gong
2026-09-04 10:31 ` Alistair
0 siblings, 1 reply; 2+ messages in thread
From: Linkai Gong @ 2026-09-01 12:26 UTC (permalink / raw)
To: Linus Walleij, Dmitry Torokhov
Cc: Alistair Francis, Maxime Ripard, Mylène Josserand,
linux-input, linux-kernel, gonglinkai
The size field comes from the device and is used as the memcpy()
length into response_buf, which is CY_MAX_INPUT bytes.
Fixes: 5b0c03e24a06 ("Input: Add driver for Cypress Generation 5 touchscreen")
Signed-off-by: Linkai Gong <gonglinkai@kylinos.cn>
---
drivers/input/touchscreen/cyttsp5.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/input/touchscreen/cyttsp5.c b/drivers/input/touchscreen/cyttsp5.c
index 9266c07314be..e878a02dc9b7 100644
--- a/drivers/input/touchscreen/cyttsp5.c
+++ b/drivers/input/touchscreen/cyttsp5.c
@@ -710,6 +710,7 @@ static irqreturn_t cyttsp5_handle_irq(int irq, void *handle)
size = 2;
} else {
report_id = ts->input_buf[2];
+ size = min(size, CY_MAX_INPUT);
}
switch (report_id) {
--
2.25.1
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [PATCH] Input: cyttsp5 - clamp the HID report size before memcpy
2026-09-01 12:26 [PATCH] Input: cyttsp5 - clamp the HID report size before memcpy Linkai Gong
@ 2026-09-04 10:31 ` Alistair
0 siblings, 0 replies; 2+ messages in thread
From: Alistair @ 2026-09-04 10:31 UTC (permalink / raw)
To: Linkai Gong, Linus Walleij, Dmitry Torokhov
Cc: Maxime Ripard, Mylène Josserand, linux-input, linux-kernel
On Tue, 2026-09-01 at 20:26 +0800, Linkai Gong wrote:
> The size field comes from the device and is used as the memcpy()
> length into response_buf, which is CY_MAX_INPUT bytes.
>
> Fixes: 5b0c03e24a06 ("Input: Add driver for Cypress Generation 5
> touchscreen")
> Signed-off-by: Linkai Gong <gonglinkai@kylinos.cn>
Reviewed-by: Alistair Francis <alistair@alistair23.me>
Alistair
> ---
> drivers/input/touchscreen/cyttsp5.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/drivers/input/touchscreen/cyttsp5.c
> b/drivers/input/touchscreen/cyttsp5.c
> index 9266c07314be..e878a02dc9b7 100644
> --- a/drivers/input/touchscreen/cyttsp5.c
> +++ b/drivers/input/touchscreen/cyttsp5.c
> @@ -710,6 +710,7 @@ static irqreturn_t cyttsp5_handle_irq(int irq,
> void *handle)
> size = 2;
> } else {
> report_id = ts->input_buf[2];
> + size = min(size, CY_MAX_INPUT);
> }
>
> switch (report_id) {
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-09-04 10:31 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-09-01 12:26 [PATCH] Input: cyttsp5 - clamp the HID report size before memcpy Linkai Gong
2026-09-04 10:31 ` Alistair
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®