[PATCH] Input: goodix - reject a bak_ref length that cannot hold the checksum

[PATCH] Input: goodix - reject a bak_ref length that cannot hold the checksum

[Liu Chao]

driver_num and sensor_num are taken from the touchscreen config.  A
config with driver_num 1 and sensor_num 0 yields a bak_ref length of
0, for which devm_kzalloc() returns ZERO_SIZE_PTR.  That pointer
passes the !ts->bak_ref check and the subsequent
ts->bak_ref[ts->bak_ref_len - 1] = 1 writes before the allocation.

Reject a length that leaves no room for the trailing checksum before
allocating, and skip saving a bak_ref that was never allocated.
Without the second check a rejected length leaves bak_ref NULL while
bak_ref_len still holds the bogus value, and goodix_save_bak_ref()
then writes through the same index on suspend.

Fixes: 09182ed20c04 ("Input: goodix - add support for controllers without flash")
Cc: stable@vger.kernel.org
Signed-off-by: Liu Chao <liuc63@xiaopeng.com>
---
 drivers/input/touchscreen/goodix_fwupload.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/input/touchscreen/goodix_fwupload.c b/drivers/input/touchscreen/goodix_fwupload.c
index 5ae9a109ba0d..888da7538c06 100644
--- a/drivers/input/touchscreen/goodix_fwupload.c
+++ b/drivers/input/touchscreen/goodix_fwupload.c
@@ -281,6 +281,8 @@ static int goodix_prepare_bak_ref(struct goodix_ts_data *ts)
 		driver_num, sensor_num, have_key);
 
 	ts->bak_ref_len = (driver_num * (sensor_num - 2) + 2) * 2;
+	if (ts->bak_ref_len < 2)
+		return -EINVAL;
 
 	ts->bak_ref = devm_kzalloc(&ts->client->dev,
 				   ts->bak_ref_len, GFP_KERNEL);
@@ -409,7 +411,7 @@ void goodix_save_bak_ref(struct goodix_ts_data *ts)
 	int error;
 	u8 val;
 
-	if (!ts->firmware_name)
+	if (!ts->firmware_name || !ts->bak_ref)
 		return;
 
 	error = goodix_i2c_read(ts->client, GOODIX_REG_STATUS, &val, 1);
-- 
2.50.1

Re: [PATCH] Input: goodix - reject a bak_ref length that cannot hold the checksum

[Dmitry Torokhov]

On Fri, Nov 06, 2026 at 03:51:29PM +0800, Liu Chao wrote:
> driver_num and sensor_num are taken from the touchscreen config.  A
> config with driver_num 1 and sensor_num 0 yields a bak_ref length of
> 0, for which devm_kzalloc() returns ZERO_SIZE_PTR.  That pointer
> passes the !ts->bak_ref check and the subsequent
> ts->bak_ref[ts->bak_ref_len - 1] = 1 writes before the allocation.
> 
> Reject a length that leaves no room for the trailing checksum before
> allocating, and skip saving a bak_ref that was never allocated.
> Without the second check a rejected length leaves bak_ref NULL while
> bak_ref_len still holds the bogus value, and goodix_save_bak_ref()
> then writes through the same index on suspend.
> 
> Fixes: 09182ed20c04 ("Input: goodix - add support for controllers without flash")
> Cc: stable@vger.kernel.org
> Signed-off-by: Liu Chao <liuc63@xiaopeng.com>

Applied, thank you.

-- 
Dmitry