From f2db017d795282fbdd5a30dc7d7712494852bf91 Mon Sep 17 00:00:00 2001 From: Linmao Li Date: Wed, 9 Sep 2026 18:07:39 +0800 Subject: [PATCH] Input: matrix-keymap - reject keycodes above KEY_MAX matrix_keypad_map_key() validates the row and column of each entry before using them to update the keymap. It does not validate the keycode before using it as a bit number in input_dev->keybit, which only has KEY_CNT bits. A malformed firmware or platform keymap can therefore write past the bitmap. Reject keycodes above KEY_MAX before updating the keymap or capability bitmap. Fixes: 77a53fd21870 ("Input: matrix-keypad - add function to build device keymap") Signed-off-by: Linmao Li Link: https://patch.msgid.link/20260909100739.3107556-1-lilinmao@kylinos.cn Signed-off-by: Dmitry Torokhov --- drivers/input/matrix-keymap.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/input/matrix-keymap.c b/drivers/input/matrix-keymap.c index 3bea3575a0a9..e4227e96aa4e 100644 --- a/drivers/input/matrix-keymap.c +++ b/drivers/input/matrix-keymap.c @@ -35,6 +35,13 @@ static bool matrix_keypad_map_key(struct input_dev *input_dev, return false; } + if (code > KEY_MAX) { + dev_err(input_dev->dev.parent, + "%s: invalid keycode %u in keymap entry 0x%x\n", + __func__, code, key); + return false; + } + keymap[MATRIX_SCAN_CODE(row, col, row_shift)] = code; __set_bit(code, input_dev->keybit);