[PATCH] Input: hynitron_cstxxx: reject out-of-range finger IDs

The driver allocates max_touch_num input slots, which are indexed from
zero through max_touch_num - 1.  The current check allows a finger ID
equal to max_touch_num to reach input_mt_report_slot_state(), resulting
in an out-of-bounds slot access.

Reject IDs at the upper bound before using them as slot indexes.

The V821 Avaota F1 board configures this driver with one touch slot, so
finger ID 1 is already invalid on that device.

Fixes: 66603243f528 ("Input: add driver for Hynitron cstxxx touchscreens")
Cc: [email protected]
Signed-off-by: Jianing Li <[email protected]>
---
 drivers/input/touchscreen/hynitron_cstxxx.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/input/touchscreen/hynitron_cstxxx.c b/drivers/input/touchscreen/hynitron_cstxxx.c
index f6139b1a8681..05e877b0d877 100644
--- a/drivers/input/touchscreen/hynitron_cstxxx.c
+++ b/drivers/input/touchscreen/hynitron_cstxxx.c
@@ -333,7 +333,7 @@ static void cst3xx_touch_report(struct i2c_client *client)
 		sw = (buf[idx] & 0x0f) >> 1;
 		finger_id = (buf[idx] >> 4) & 0x0f;
 
 		/* Sanity check we don't have more fingers than we expect */
-		if (ts_data->chip->max_touch_num < finger_id) {
+		if (finger_id >= ts_data->chip->max_touch_num) {
 			dev_err(&client->dev, "cst3xx touch read failure\n");
 			break;
 		}
-- 
2.45.2