github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-06 21:58:01 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

Input: matrix-keymap - reject keycodes above KEY_MAX

Browse Source 
matrix_keypad_map_key() validates the row and column of each entry before
using them to update the keymap. It does not validate the keycode before
using it as a bit number in input_dev->keybit, which only has KEY_CNT bits.
A malformed firmware or platform keymap can therefore write past the
bitmap.

Reject keycodes above KEY_MAX before updating the keymap or capability
bitmap.

Fixes: 77a53fd218 ("Input: matrix-keypad - add function to build device keymap")
Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
Link: https://patch.msgid.link/20260909100739.3107556-1-lilinmao@kylinos.cn
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
This commit is contained in:
Linmao Li 2026-09-09 18:07:39 +08:00 committed by Dmitry Torokhov
parent e0e8f43517
commit f2db017d79
1 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
drivers/input/matrix-keymap.c
View File

@ -35,6 +35,13 @@ static bool matrix_keypad_map_key(struct input_dev *input_dev,
return false;
}
if (code > KEY_MAX) {
dev_err(input_dev->dev.parent,
"%s: invalid keycode %u in keymap entry 0x%x\n",
__func__, code, key);
return false;
}
keymap[MATRIX_SCAN_CODE(row, col, row_shift)] = code;
__set_bit(code, input_dev->keybit);