From nobody Mon Jun 8 19:46:43 2026 Received: from mail-pl1-f178.google.com (mail-pl1-f178.google.com [209.85.214.178]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F1CA6264A97 for ; Wed, 27 May 2026 00:46:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.178 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779842763; cv=none; b=JumsGKek9Mykvl5Rq1kAIV+X29vmCMufCpjwvNgUWwrvtVAMFt/vyeU33i9ksKqhAe8nfyEgtSSGJpGMR6fP3rnCDjMDGKZA//h6eC/gyoVrpjApegivL9ilpaCaacnrG2D0jW0+ZhdvnXbzsO3VT+BRDA3OiypnZ7cI6t1N970= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779842763; c=relaxed/simple; bh=Bn1htifDFvdqLQpyJKhO0AyLQDMJSMocQOzxJZJiq5w=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=DHWNAu7kGvigIhLTbn3+0hXgcKXebJSorWTG20yxSyyo+jdt881l31kr1WZZQa86M1TU7jr0pjmR/N2wkHWhWI4X4Clie6e2C0bcUBM/oibiIbuB64nkLaDDp4HV0PQP46GRSocsQAbFxfwxwHjNOzZP+6iRjCfGH88URR9yuno= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=PI1wNtaW; arc=none smtp.client-ip=209.85.214.178 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="PI1wNtaW" Received: by mail-pl1-f178.google.com with SMTP id d9443c01a7336-2ba17c8cfacso117309665ad.2 for ; Tue, 26 May 2026 17:46:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1779842761; x=1780447561; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=/qmpMpDGto5NskeOa7RLSttaP2uOAMocijbFFRGCfIw=; b=PI1wNtaWrNhAu50nauSLNejNQYZ2tkIhd6uVy2AOr4OVvm0a/3/xg7STVNT6djurzh 8zuWHSdRqts8DmtKAblHTn6pg74v5Y41NRD9p/GxfOBh1nQ0/cCixNMK3+5HH3rxXPOt tbNjj26S38Fqph8qjaYNnaAKM8jciwzNVzvECPB+jHzVgttu21wbztsPqZ3SqGELEqyO qK+SHYKBGfE/3Z2btelGwe13U/EIBZgRvxiIvgG+mSuEYh1y+6P51EcRs4UH7zlZ9k/f +IX+zKTGcj+PCtK+IWb45nCWLp4w5ZtxW2Y5/jjQjBDxOwvo10gF6gdQDWhj2RO9aANY Ry9g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779842761; x=1780447561; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=/qmpMpDGto5NskeOa7RLSttaP2uOAMocijbFFRGCfIw=; b=mYkhqI31FksMx7kyHrBRg6q/kDDElXDs+Orp/+GYZWPE921jDS0A8b2Wzix7rPtoOw GH+g2QZZERz04TJQ0/5dd4A9CC5UqTDBAXLbbm5qNJR6LNw1txd8YEoJLvzPsmKDijZv ot1B7S6UpDbXorms25WS2tqH0/se8+Ut1ZZCEkV/4nLnVATFb8BrQm14wA3ZfOH6Obtp hKmkEXkHnmVplGZBqj7rRVe+H4PypGMh5B3oOSS93eClD4VKA0RXNgtVTAtuAH0kEwip 72tjxogF1qZujHayML1L/P1st3KIetd4qdA7wz4ezMD0d0OVnHt0da5kSOosQz/4EZGj DwAA== X-Forwarded-Encrypted: i=1; AFNElJ+Fljh+e7db2Zcqyd8Jawd8SGNvI9nCsU6ZhLsd1f8DdULlOJG7yMpmhlrPxqCRGsNR7MipJbQ6AD4BlVs=@vger.kernel.org X-Gm-Message-State: AOJu0Ywzn9W8cSZueaFI4NMOBjgzASxI9heS4SFT1xu3DnfvT4OWPRd5 InyZAmJhuoV/2sFDEm19aX2oWtYawoSTYpLWUKBPdIRxuA1Q2Vd2DRAr X-Gm-Gg: Acq92OFT1mOJZYsi8OOJlxVeMEPJtoohuBLedBccBEIyE7TaKTn0NPUUPIaQalqT1j2 xe8FbQ/x8ej9VtgZv5L30IofP2h+HUWEaDsPSAnHiyMux6sll3HxSrdc0sT18zLLT0+K12TPZQP C42S2ijDwMoEE2k2kN9MQ0ChYTJ+uEzIXl74u5ZhJFme9fzp3Y1fdkok49Pe49RWdwq2hhAq9xp J5i3tCJJxyhlHYFO7CHOaIbMV2uUb2mnhNzUc2MjdtkpNn7itER6PV8riw6sMLJGYmR/b7ERBTM wbbhTGbhiE1+d9L8IlGzKFoi6XsORz3GBTxADq+zqgDjXjrBlyWCuAORldRxLWwoSM1BwkqBS4B yKIpvN8onnXlgboE1wubvAhHNiiE+pexm++uEu9/8h0q1tlMdw3Ki/dT4apsSg8OZfpt22Gww12 T9YjRf0xdhA+pgDYfnn+6JnJXn0zDCMYN1cQRHZl8V+4TzGvCwD2iyRli9aOGfZBvptUNpgx+xn Q0OT8fycRQ3DzLsl10Psdfk79zaPQPQvRY= X-Received: by 2002:a17:903:41c9:b0:2bd:5ab:af95 with SMTP id d9443c01a7336-2beb023584amr219157495ad.0.1779842761021; Tue, 26 May 2026 17:46:01 -0700 (PDT) Received: from ryzen ([2601:644:8000:5b5d:7285:c2ff:fe45:8a32]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2beb58b2ea3sm138552635ad.43.2026.05.26.17.45.59 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 26 May 2026 17:46:00 -0700 (PDT) From: Rosen Penev To: linux-input@vger.kernel.org Cc: Dmitry Torokhov , Matthias Brugger , AngeloGioacchino Del Regno , linux-kernel@vger.kernel.org (open list:ARM/Mediatek SoC support), linux-arm-kernel@lists.infradead.org (moderated list:ARM/Mediatek SoC support), linux-mediatek@lists.infradead.org (moderated list:ARM/Mediatek SoC support) Subject: [PATCH] Input: mtk-pmic-keys - match loop with count Date: Tue, 26 May 2026 17:45:43 -0700 Message-ID: <20260527004543.22875-1-rosenp@gmail.com> X-Mailer: git-send-email 2.54.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" of_get_available_child_count is used along with for_each_child_of_node_scoped, which can cause a mismatch when keys have a disabled status. If a disabled child node exists in the device tree alongside available ones, the loop could execute more times than the initial validation accounted for. This might increment the index variable past the allocated array bounds, leading to out-of-bounds accesses on irqnames[] and keys->keys[]. Signed-off-by: Rosen Penev --- drivers/input/keyboard/mtk-pmic-keys.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/input/keyboard/mtk-pmic-keys.c b/drivers/input/keyboar= d/mtk-pmic-keys.c index c78d9f6d97c4..5d4ebbafd276 100644 --- a/drivers/input/keyboard/mtk-pmic-keys.c +++ b/drivers/input/keyboard/mtk-pmic-keys.c @@ -363,7 +363,7 @@ static int mtk_pmic_keys_probe(struct platform_device *= pdev) return -EINVAL; } =20 - for_each_child_of_node_scoped(node, child) { + for_each_available_child_of_node_scoped(node, child) { keys->keys[index].regs =3D &mtk_pmic_regs->keys_regs[index]; =20 keys->keys[index].irq =3D --=20 2.54.0