]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
Input: ti_am335x_tsc - fix off-by-one error in wire_order validation
authorJunjie Cao <junjie.cao@intel.com>
Fri, 19 Dec 2025 05:56:59 +0000 (21:56 -0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 19 Jan 2026 12:09:45 +0000 (13:09 +0100)
commit136abe173a3cc2951d70c6e51fe7abdbadbb204b
tree52db6bab75725d37f829313ea6d79bb13a68589e
parentac6b3033d1e5cddec412913a52849d57c0cbc165
Input: ti_am335x_tsc - fix off-by-one error in wire_order validation

commit 248d3a73a0167dce15ba100477c3e778c4787178 upstream.

The current validation 'wire_order[i] > ARRAY_SIZE(config_pins)' allows
wire_order[i] to equal ARRAY_SIZE(config_pins), which causes out-of-bounds
access when used as index in 'config_pins[wire_order[i]]'.

Since config_pins has 4 elements (indices 0-3), the valid range for
wire_order should be 0-3. Fix the off-by-one error by using >= instead
of > in the validation check.

Signed-off-by: Junjie Cao <junjie.cao@intel.com>
Link: https://patch.msgid.link/20251114062817.852698-1-junjie.cao@intel.com
Fixes: bb76dc09ddfc ("input: ti_am33x_tsc: Order of TSC wires, made configurable")
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/input/touchscreen/ti_am335x_tsc.c