Input: edt-ft5x06 - ignore contacts with an out-of-range slot id

The per-contact slot id is taken from the top nibble of the third
report byte, so it can be any value from 0 to 15. The driver only
allocates max_support_points MT slots (2 to 10 depending on the
variant), so a report that carries an id at or above that count - be it
a genuinely higher-numbered contact or a corrupted byte - is outside the
range the input core was told about.

input_mt_slot() silently ignores an ABS_MT_SLOT beyond num_slots and
leaves the current slot unchanged, so the following
input_mt_report_slot_state()/touchscreen_report_pos() pair is applied to
whichever slot happened to be selected last, reporting the contact at the
wrong position. Skip such entries instead.

Signed-off-by: Alexandre Hamamdjian <azkali.limited@gmail.com>
Link: https://patch.msgid.link/20260723-b4-ft5426-v2-1-cd2bed168051@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

diff --git a/drivers/input/touchscreen/edt-ft5x06.c b/drivers/input/touchscreen/edt-ft5x06.c
index d3b1177185a3b318b4ee65552b72a15eb8f7e953..d6c3d033b83df0de4f14a5a69a72e7f1a59de193 100644 (file)
--- a/drivers/input/touchscreen/edt-ft5x06.c
+++ b/drivers/input/touchscreen/edt-ft5x06.c
@@ -331,6 +331,8 @@ static irqreturn_t edt_ft5x06_ts_isr(int irq, void *dev_id)
                        swap(x, y);
 
                id = (buf[2] >> 4) & 0x0f;
+               if (id >= tsdata->max_support_points)
+                       continue;
 
                input_mt_slot(tsdata->input, id);
                if (input_mt_report_slot_state(tsdata->input, MT_TOOL_FINGER,