Re: [PATCH] Input: goodix - reject a bak_ref length that cannot hold the checksum

[Dmitry Torokhov <dmitry.torokhov@gmail.com>]

On Fri, Nov 06, 2026 at 03:51:29PM +0800, Liu Chao wrote:
> driver_num and sensor_num are taken from the touchscreen config.  A
> config with driver_num 1 and sensor_num 0 yields a bak_ref length of
> 0, for which devm_kzalloc() returns ZERO_SIZE_PTR.  That pointer
> passes the !ts->bak_ref check and the subsequent
> ts->bak_ref[ts->bak_ref_len - 1] = 1 writes before the allocation.
> 
> Reject a length that leaves no room for the trailing checksum before
> allocating, and skip saving a bak_ref that was never allocated.
> Without the second check a rejected length leaves bak_ref NULL while
> bak_ref_len still holds the bogus value, and goodix_save_bak_ref()
> then writes through the same index on suspend.
> 
> Fixes: 09182ed20c04 ("Input: goodix - add support for controllers without flash")
> Cc: stable@vger.kernel.org
> Signed-off-by: Liu Chao <liuc63@xiaopeng.com>

Applied, thank you.

-- 
Dmitry