matrix_keypad_map_key() validates the row and column of each entry before
using them to update the keymap. It does not validate the keycode before
using it as a bit number in input_dev->keybit, which only has KEY_CNT bits.
A malformed firmware or platform keymap can therefore write past the
bitmap.

Reject keycodes above KEY_MAX before updating the keymap or capability
bitmap.

Fixes: 77a53fd21870 ("Input: matrix-keypad - add function to build device keymap")
Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
---
 drivers/input/matrix-keymap.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/input/matrix-keymap.c b/drivers/input/matrix-keymap.c
index 3bea3575a0a9..e4227e96aa4e 100644
--- a/drivers/input/matrix-keymap.c
+++ b/drivers/input/matrix-keymap.c
@@ -35,6 +35,13 @@ static bool matrix_keypad_map_key(struct input_dev *input_dev,
 		return false;
 	}
 
+	if (code > KEY_MAX) {
+		dev_err(input_dev->dev.parent,
+			"%s: invalid keycode %u in keymap entry 0x%x\n",
+			__func__, code, key);
+		return false;
+	}
+
 	keymap[MATRIX_SCAN_CODE(row, col, row_shift)] = code;
 	__set_bit(code, input_dev->keybit);
 

base-commit: 944a035ecca915ae947905dcfb03f2b9dc6d032c
-- 
2.25.1

On Wed, Sep 09, 2026 at 06:07:39PM +0800, Linmao Li wrote:
> matrix_keypad_map_key() validates the row and column of each entry before
> using them to update the keymap. It does not validate the keycode before
> using it as a bit number in input_dev->keybit, which only has KEY_CNT bits.
> A malformed firmware or platform keymap can therefore write past the
> bitmap.
> 
> Reject keycodes above KEY_MAX before updating the keymap or capability
> bitmap.
> 
> Fixes: 77a53fd21870 ("Input: matrix-keypad - add function to build device keymap")
> Signed-off-by: Linmao Li <lilinmao@kylinos.cn>

Applied, thank you.

-- 
Dmitry