Input: cyttsp5 - clamp the HID report size before memcpy

[PATCH] Input: cyttsp5 - clamp the HID report size before memcpy

Posted by Linkai Gong 3 weeks, 3 days ago

The size field comes from the device and is used as the memcpy()
length into response_buf, which is CY_MAX_INPUT bytes.

Fixes: 5b0c03e24a06 ("Input: Add driver for Cypress Generation 5 touchscreen")
Signed-off-by: Linkai Gong <gonglinkai@kylinos.cn>
---
 drivers/input/touchscreen/cyttsp5.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/input/touchscreen/cyttsp5.c b/drivers/input/touchscreen/cyttsp5.c
index 9266c07314be..e878a02dc9b7 100644
--- a/drivers/input/touchscreen/cyttsp5.c
+++ b/drivers/input/touchscreen/cyttsp5.c
@@ -710,6 +710,7 @@ static irqreturn_t cyttsp5_handle_irq(int irq, void *handle)
 		size = 2;
 	} else {
 		report_id = ts->input_buf[2];
+		size = min(size, CY_MAX_INPUT);
 	}
 
 	switch (report_id) {
-- 
2.25.1

Re: [PATCH] Input: cyttsp5 - clamp the HID report size before memcpy

Posted by Alistair 3 weeks, 1 day ago

On Tue, 2026-09-01 at 20:26 +0800, Linkai Gong wrote:
> The size field comes from the device and is used as the memcpy()
> length into response_buf, which is CY_MAX_INPUT bytes.
> 
> Fixes: 5b0c03e24a06 ("Input: Add driver for Cypress Generation 5
> touchscreen")
> Signed-off-by: Linkai Gong <gonglinkai@kylinos.cn>

Reviewed-by: Alistair Francis <alistair@alistair23.me>

Alistair

> ---
>  drivers/input/touchscreen/cyttsp5.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/input/touchscreen/cyttsp5.c
> b/drivers/input/touchscreen/cyttsp5.c
> index 9266c07314be..e878a02dc9b7 100644
> --- a/drivers/input/touchscreen/cyttsp5.c
> +++ b/drivers/input/touchscreen/cyttsp5.c
> @@ -710,6 +710,7 @@ static irqreturn_t cyttsp5_handle_irq(int irq,
> void *handle)
>  		size = 2;
>  	} else {
>  		report_id = ts->input_buf[2];
> +		size = min(size, CY_MAX_INPUT);
>  	}
>  
>  	switch (report_id) {