]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem
authorDmitry Torokhov <dmitry.torokhov@gmail.com>
Mon, 4 May 2026 18:54:45 +0000 (11:54 -0700)
committerDmitry Torokhov <dmitry.torokhov@gmail.com>
Thu, 7 May 2026 17:09:05 +0000 (10:09 -0700)
commitbaa0210fb6a9dc3882509a9411b6d284d88fe30e
treeec979f04e6d132590ff0f97156541a9d41902428
parent74d695fd6f9d70df849c555f358ddfd26e2d85bf
Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem

When a configuration file provides an object size that is larger than the
driver's known mxt_obj_size(object), the driver intends to discard the
extra bytes.

The loop iterates using for (i = 0; i < size; i++). Inside the loop, the
condition to skip processing extra bytes is:

    if (i > mxt_obj_size(object))
        continue;

Since i is a 0-based index, the valid indices for the object are 0 through
mxt_obj_size(object) - 1.

When i == mxt_obj_size(object), the condition evaluates to false, and the
code processes the byte instead of discarding it.

This causes the code to calculate byte_offset = reg + i - cfg->start_ofs
and writes the byte there, overwriting exactly one byte of the adjacent
instance or object.

Update the boundary check to skip extra bytes correctly by using >=.

Fixes: 50a77c658b80 ("Input: atmel_mxt_ts - download device config using firmware loader")
Cc: stable@vger.kernel.org
Assisted-by: Gemini:gemini-3.1-pro
Reviewed-by: Ricardo Ribalda <ribalda@chromium.org>
Link: https://patch.msgid.link/20260504185448.4055973-1-dmitry.torokhov@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
drivers/input/touchscreen/atmel_mxt_ts.c