From 0aa7c205e901ad75f4785f786b32a2b01b896a9b Mon Sep 17 00:00:00 2001 From: Pengpeng Hou Date: Wed, 15 Jul 2026 16:38:50 +0800 Subject: [PATCH] Input: iqs5xx - validate firmware record destination span The firmware record parser checks that the record address starts within the programmable map, but does not check that the complete record data fits in that map. A record near the end of the map can therefore make the copy to pmap exceed its destination span. Check the record length against the remaining programmable map range before copying the record data. Fixes: 7b5bb55d0dad ("Input: add support for Azoteq IQS550/572/525") Signed-off-by: Pengpeng Hou Link: https://patch.msgid.link/20260715083850.32155-1-pengpeng@iscas.ac.cn Signed-off-by: Dmitry Torokhov --- drivers/input/touchscreen/iqs5xx.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/input/touchscreen/iqs5xx.c b/drivers/input/touchscreen/iqs5xx.c index c3cc37274335..88dcf72618df 100644 --- a/drivers/input/touchscreen/iqs5xx.c +++ b/drivers/input/touchscreen/iqs5xx.c @@ -785,7 +785,8 @@ static int iqs5xx_fw_file_parse(struct i2c_client *client, switch (rec_type) { case IQS5XX_REC_TYPE_DATA: if (rec_addr < IQS5XX_CHKSM || - rec_addr > IQS5XX_PMAP_END) { + rec_addr > IQS5XX_PMAP_END || + rec_len > IQS5XX_PMAP_END + 1 - rec_addr) { dev_err(&client->dev, "Invalid address at record %u\n", rec_num);