Re: [PATCH v2] Input: hynitron_cstxxx: validate touch count and finger IDs

Thank you for your contribution! Sashiko AI review found 1 potential issue(=
s) to consider:

Pre-existing issues:
- [High] The driver passes stack-allocated buffers directly to I2C transfer=
 functions, which violates DMA mapping rules and can cause kernel panics or=
 data corruption.
--

--- Patch [1]: [PATCH v2] Input: hynitron_cstxxx: validate touch count and =
finger IDs ---
commit cf5d1ec7af0f8cb9ee23a1f75f59f7e64afb8fe7
Author: Jianing Li <[email protected]>

Input: hynitron_cstxxx: validate touch count and finger IDs

This commit adds bounds checking for the touch count and finger ID read
from the controller. It ensures that neither exceeds max_touch_num,
preventing out-of-bounds slot accesses during input reporting.

> diff --git a/drivers/input/touchscreen/hynitron_cstxxx.c b/drivers/input/=
touchscreen/hynitron_cstxxx.c
> index f6139b1a86811..5f2737fe99026 100644
> --- a/drivers/input/touchscreen/hynitron_cstxxx.c
> +++ b/drivers/input/touchscreen/hynitron_cstxxx.c
> @@ -312,6 +312,11 @@ static void cst3xx_touch_report(struct i2c_client *c=
lient)
>  		return;
> =20
>  	touch_cnt =3D buf[5] & CST3XX_TOUCH_COUNT_MASK;

[Severity: High]
This is a pre-existing issue, but I noticed that buf is a stack-allocated
array in cst3xx_touch_report() that is passed to i2c_transfer() via
cst3xx_i2c_read_register() earlier in the function.

If the I2C host controller maps the buffers for DMA, passing a stack-alloca=
ted
buffer can lead to memory corruption, kernel panics, or DMA API debug warni=
ngs
because stack memory is not DMA-safe (especially with virtual kernel stacks
enabled).

Looking at the rest of drivers/input/touchscreen/hynitron_cstxxx.c, similar
stack allocations occur in other functions:

cst3xx_i2c_read_register() allocates __le16 buf
cst3xx_firmware_info() allocates unsigned char buf[4]
cst3xx_bootloader_enter() allocates unsigned char buf[3]
cst3xx_finish_touch_read() allocates unsigned char buf[3]

Should these buffers be heap-allocated or moved to a DMA-safe allocation
within the device structure to prevent DMA corruption?

> +	if (touch_cnt > ts_data->chip->max_touch_num) {
> +		dev_err(&client->dev, "cst3xx touch read failure\n");
> +		return;
> +	}
> +
>  	/*
>  	 * Check the check bit of the last touch slot. The check bit is
>  	 * always present after touch point 1 for valid data, and then
[ ... ]

--=20
Sashiko AI review =C2=B7 https://sashiko.dev/#/patchset/20260804031339.2379=
[email protected]?part=3D1