From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f180.google.com (mail-pl1-f180.google.com [209.85.214.180]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3DD1C37FF43 for ; Sun, 26 Jul 2026 11:15:45 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.180 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785064546; cv=none; b=NGh59wFCMQZ3oIlJ+WSjIOLdvoz83OQ/TwvjWDyheAJJ60QYi6fhLpWA26W3EQy9DsRPLBzAiEctS0e5R8iKUKnrsjb0szn96W+sVSAxBy0eUYIHcjbeMooO7tiXuMqzAUAaou8dy76zN4zROM9lZJl+/6MaxoLG1B7Sck/KE+c= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785064546; c=relaxed/simple; bh=XhVXEKtqspLI441uWo3QuIRBqXLhGYrFvjuFf4r/qj0=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=dlk1b4Lfu1EbIzIykJeyqwh68JD/ZLMxSWtl/xS346HSemjq5C107zay9o84rmc/TqKMjoqjZJ7R1+xUwpXLEubvQUxwTh9UdvobFsfcSl6m75yO6V9TayeRl3no07LRcWAGp+8e/VOhkaNcSfjql4kdGB2vQu9y5kox7JHZtOA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Pu61xWw/; arc=none smtp.client-ip=209.85.214.180 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Pu61xWw/" Received: by mail-pl1-f180.google.com with SMTP id d9443c01a7336-2cacb8416a1so17232125ad.1 for ; Sun, 26 Jul 2026 04:15:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1785064544; x=1785669344; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=k9b9/6dXenhTUKOJCIHLIq7fadOmj44kmHH5pPyMEgE=; b=Pu61xWw/gcTWeL4Waw5O6OCK2yzwBBWqHBdNfUsKebEW+AlTwf4VXbttAzCwZLPt2m DxCnjeeODXwdl0Cm1VOBCsGxOOpcFkchMdYV7H9H0fk5z5hkCY4o6PIGeBYIOD3eAYAz kj+Sqi0lPjEK9c/c4p6m2Thf9W++3pdp+Sm1pzsRuFG4IO1iQF0tbYqKtMPDN4jZiRwR H+avA/MrHnUqjdNs8l4NPQwlTmH3i1eI+TUGntZeTjJVY1O8fd2bh8KTfh2hX4NLSl5/ CGdjImmgFaeUBvsDEGUskr821KLaOqBC7W9H1MFA85YxS8G7QULmoIdwHYqI9EdHvOnG D23g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785064544; x=1785669344; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=k9b9/6dXenhTUKOJCIHLIq7fadOmj44kmHH5pPyMEgE=; b=Hrf+F74NtSbnWzz9WfCjyh6Jnd31NT6wntnLUIAckW9klTjbGjdg1lmK7qOavKNyUG W8gA3N6mlzInLn81WcuKhgCVQi+vGfMpnk+18IV/vqKXV7OJaSYvnHqXa4UUBkalVRCH HdC9Ix78r0IbzXu68iyhjOLvlRkilbXNzEYsdwg4PylDBVGViHfIgUe0KQX0rW7izfr2 5pOiZpmFqVLzw9ZF+wJb2tIbTbUu7qbe7HGfbkW/aT8h5iQsY0HFMs+rDQSvamf9Rh/Y Qx1cmVuONaOlFTNh8UxSMq+u8n1BnrjLiZ0M68uYiG4tRVhBCjfCkSzGRXivv92SjpQP 0F5Q== X-Forwarded-Encrypted: i=1; AHgh+RremD3wydL++1bMsSNQw6pFCZYTxmal6pAGJQizwoBNmseXMP0Q6OC2yahcvdmqU+fsQ7enI82YEVg2w00=@vger.kernel.org X-Gm-Message-State: AOJu0Ywbd9XgVpaZ5X6dNnjMbSKy75dX65FlxJlc9ryo5mZ96ra5NqqP akUOiKl20y8BEo79dioKjDsaPd8IuL5IapbFhJxMnT7DdW+h2lxRDHoX X-Gm-Gg: AR+sD11lbo3cqZChzYp6x4/70aiSLbqDMTJV+H1zpPuQsSqjnLZjoDK4H9y2hlcU4iP lcVF8pHtPuZ1TRpW2TsldG5dq5Z58bkkKsS0pKZRWshl1lOfuNUjC4PrvJfd1rPjpTAoDpqNq+Z PZ0ux2qyKvJeJa4Wl5F054WwNKjjhb+uGWTT9jfD7YVMFLy2eupLdqsjdDon9bhvXEn77Jm1wPv IjPgrlgXUSS8HrNbJHFcPGddYH69rCN/Ora48u449GMcU0LBme9VS1zBflzq/6eUHh8sHlOxMXz TQtpne4WZOhCZqvE75/7CAItUPTOaveJtAKR5EIek8e69W5B1+cxrRybcBU1dfRYvaX5KysWkwc CLf/CZmaRgvqY83+JkJ139LWxjCScW2ZXT/+Ol3sV1SydZiVDlEEOBZeLoGE8/vIgD5Ysl/zNh9 PaQxzGwJOtWY93TxezTAEgwrSfr4uHvYXQrQhqyLl6NwKO2Abr X-Received: by 2002:a17:902:ef4f:b0:2cf:83bf:6b05 with SMTP id d9443c01a7336-2cfde86bac2mr42423935ad.41.1785064544371; Sun, 26 Jul 2026 04:15:44 -0700 (PDT) Received: from lza-virtual-machine.localdomain ([120.236.174.211]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2cfde7bc585sm19192805ad.51.2026.07.26.04.15.41 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 26 Jul 2026 04:15:44 -0700 (PDT) From: Zhian Liang To: Dmitry Torokhov Cc: linux-input@vger.kernel.org, linux-kernel@vger.kernel.org, Zhian Liang , stable@vger.kernel.org Subject: [PATCH v3] Input: tca8418_keypad - fix potential infinite loop and OOB access on invalid keycodes Date: Sun, 26 Jul 2026 19:15:02 +0800 Message-Id: <20260726111502.2252-1-liangzhan5dev@gmail.com> X-Mailer: git-send-email 2.34.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit If the hardware returns 0xFF (e.g., due to a stuck bus or device fault), the loop never terminates and the extracted keycode causes an out-of-bounds access on keymap[]. Move the empty-FIFO check to operate on the extracted key code so that the loop terminates correctly. Additionally, validate row/column indices against the configured matrix dimensions before indexing into the keymap array, skipping invalid events. Cc: stable@vger.kernel.org Signed-off-by: Zhian Liang --- changes in v2: - Moved empty-FIFO check to operate on extracted key code instead of raw register value. - Added row/col validation against configured matrix dimensions. - Dropped explicit 0xFF check as requested. --- changes in v3: -Fix mailer line-wrapping -No code changes Signed-off-by: Zhian Liang --- drivers/input/keyboard/tca8418_keypad.c | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-) diff --git a/drivers/input/keyboard/tca8418_keypad.c b/drivers/input/keyboard/tca8418_keypad.c index b124e576feca..36d4a7c38bb1 100644 --- a/drivers/input/keyboard/tca8418_keypad.c +++ b/drivers/input/keyboard/tca8418_keypad.c @@ -114,6 +114,8 @@ struct tca8418_keypad { struct input_dev *input; unsigned int row_shift; + unsigned int rows; + unsigned int cols; }; /* @@ -171,19 +173,28 @@ static void tca8418_read_keypad(struct tca8418_keypad *keypad_data) break; } - /* Assume that key code 0 signifies empty FIFO */ - if (reg <= 0) - break; state = reg & KEY_EVENT_VALUE; code = reg & KEY_EVENT_CODE; + /* Key code 0 signifies empty FIFO */ + if (!code) + break; + row = code / TCA8418_MAX_COLS; col = code % TCA8418_MAX_COLS; row = (col) ? row : row - 1; col = (col) ? col - 1 : TCA8418_MAX_COLS - 1; + /* Validate against configured matrix size */ + if (row >= keypad_data->rows || col >= keypad_data->cols) { + dev_err(&keypad_data->client->dev, + "invalid key code %d (row %d, col %d)\n", + code, row, col); + continue; + } + code = MATRIX_SCAN_CODE(row, col, keypad_data->row_shift); input_event(input, EV_MSC, MSC_SCAN, code); input_report_key(input, keymap[code], state); @@ -298,6 +309,8 @@ static int tca8418_keypad_probe(struct i2c_client *client) keypad_data->client = client; keypad_data->row_shift = row_shift; + keypad_data->rows = rows; + keypad_data->cols = cols; /* Read key lock register, if this fails assume device not present */ error = tca8418_read_byte(keypad_data, REG_KEY_LCK_EC, ®); -- 2.34.1