Input: atmel_mxt_ts - check mem_size before calculating config memory size

In mxt_update_cfg(), the driver calculates the memory size needed to store
the configuration as data->mem_size - cfg.start_ofs. If data->mem_size is
less than or equal to cfg.start_ofs, this calculation will underflow or
result in a zero-size buffer, neither of which is valid for a configuration
update.

Add a check to return -EINVAL if data->mem_size is too small. While at it,
change the types of start_ofs and mem_size in struct mxt_cfg to u16 to
match the device address space.

Assisted-by: Gemini:gemini-3.1-pro
Link: https://patch.msgid.link/20260504185448.4055973-2-dmitry.torokhov@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c b/drivers/input/touchscreen/atmel_mxt_ts.c
index fad1b3f4138b8cbb5d99ef04680f8495985a007f..f21bf28441126bb31aff0c38217908f124ae1a09 100644 (file)
--- a/drivers/input/touchscreen/atmel_mxt_ts.c
+++ b/drivers/input/touchscreen/atmel_mxt_ts.c
@@ -275,8 +275,8 @@ struct mxt_cfg {
        off_t raw_pos;
 
        u8 *mem;
-       size_t mem_size;
-       int start_ofs;
+       u16 mem_size;
+       u16 start_ofs;
 
        struct mxt_info info;
 };
@@ -1627,6 +1627,13 @@ static int mxt_update_cfg(struct mxt_data *data, const struct firmware *fw)
        cfg.start_ofs = MXT_OBJECT_START +
                        data->info->object_num * sizeof(struct mxt_object) +
                        MXT_INFO_CHECKSUM_SIZE;
+
+       if (data->mem_size <= cfg.start_ofs) {
+               dev_err(dev, "Memory size too small: %u < %u\n",
+                       data->mem_size, cfg.start_ofs);
+               return -EINVAL;
+       }
+
        cfg.mem_size = data->mem_size - cfg.start_ofs;
 
        u8 *mem_buf __free(kfree) = cfg.mem = kzalloc(cfg.mem_size, GFP_KERNEL);