diff options
| author | Linmao Li <lilinmao@kylinos.cn> | 2026-09-09 18:07:39 +0800 |
|---|---|---|
| committer | Dmitry Torokhov <dmitry.torokhov@gmail.com> | 2026-09-13 17:17:23 -0700 |
| commit | f2db017d795282fbdd5a30dc7d7712494852bf91 (patch) | |
| tree | e2effba4cc432993fa70bff653bcb6050c16a4e5 /drivers/input | |
| parent | e0e8f43517dddf01c7fb82a3bd64b9096b90a3f1 (diff) | |
| download | linux-f2db017d795282fbdd5a30dc7d7712494852bf91.tar.gz linux-f2db017d795282fbdd5a30dc7d7712494852bf91.zip | |
Input: matrix-keymap - reject keycodes above KEY_MAX
matrix_keypad_map_key() validates the row and column of each entry before
using them to update the keymap. It does not validate the keycode before
using it as a bit number in input_dev->keybit, which only has KEY_CNT bits.
A malformed firmware or platform keymap can therefore write past the
bitmap.
Reject keycodes above KEY_MAX before updating the keymap or capability
bitmap.
Fixes: 77a53fd21870 ("Input: matrix-keypad - add function to build device keymap")
Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
Link: https://patch.msgid.link/20260909100739.3107556-1-lilinmao@kylinos.cn
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Diffstat (limited to 'drivers/input')
| -rw-r--r-- | drivers/input/matrix-keymap.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/drivers/input/matrix-keymap.c b/drivers/input/matrix-keymap.c index 3bea3575a0a9..e4227e96aa4e 100644 --- a/drivers/input/matrix-keymap.c +++ b/drivers/input/matrix-keymap.c @@ -35,6 +35,13 @@ static bool matrix_keypad_map_key(struct input_dev *input_dev, return false; } + if (code > KEY_MAX) { + dev_err(input_dev->dev.parent, + "%s: invalid keycode %u in keymap entry 0x%x\n", + __func__, code, key); + return false; + } + keymap[MATRIX_SCAN_CODE(row, col, row_shift)] = code; __set_bit(code, input_dev->keybit); |