Re: [PATCH v7 4/4] Input: Add TouchNetix aXiom I2C Touchscreen support

On 26-08-03, Dmitry Torokhov wrote:
> On Thu, Jul 02, 2026 at 10:48:04PM +0000, [email protected] wrote:
> > Thank you for your contribution! Sashiko AI review found 18 potential issue(s) to consider:
> > - [High] Missing bounds checking during firmware chunk parsing allows malformed firmware to trigger integer underflow and out-of-bounds memory accesses.
> > - [High] Invalid cast of regmap buffer to u16* causes endian-dependent behavior and corrupts register addresses.
> > - [High] Unbalanced pm_runtime_put in firmware upload cleanup leads to negative PM usage counts.
> > - [High] Firmware-controlled allocation size allows out-of-bounds heap read when checking touch slots.
> > - [High] The driver prevents firmware recovery when the device boots in bootloader mode by improperly failing the probe.
> > - [High] fwupdate_lock is held across system calls violating kernel mutex semantics, and is double-unlocked on error paths.
> > - [High] Improper devm teardown order causes Use-After-Free of the input device by background firmware upload threads.
> 
> I am not sure this is true as sysfs attributes should be removed iand
> handlers complete before we get to remove() method. 
> 
> > - [High] Use-after-free of ts->input in the threaded IRQ handler during config firmware updates and device removal.
> > - [High] The driver waits on completion primitives for hardware resets and saves without reinitializing them, causing future waits to falsely succeed immediately.
> > - [High] The driver passes stack-allocated buffers to I2C transfers, which violates DMA requirements and can cause memory corruption.
> 
> This is Sashiko's hallucination.
> 
> > - [High] NULL pointer dereference in `axiom_remove_axfw_fwl_action` if `devm_add_action_or_reset` fails.
> > - [Medium] An operator precedence error in subtracting the preamble and postamble causes the calculated report payload length to be artificially inflated.
> > - [Medium] Probe error paths leak PM runtime references and fail to disable regulators.
> > - [Medium] I2C read errors are swallowed and falsely reported as success in polling functions.
> > - [Medium] Missing NULL check on `kasprintf` results in a crash or broken sysfs state when registering the firmware upload interfaces.
> > - [Medium] The driver lacks system sleep power management callbacks, causing the device to remain powered on during system suspend if not acting as a panel follower.
> > - [Medium] Dead code in `axiom_register_input_dev` prevents failing initialization when no touchslots are enabled.
> > - [Low] Typo in the sysfs `device_state` output violates the documented ABI.
> > --
> 
> However there appears to be quite a few items that need addressing.

Already on it.

Regards,
  Marco

> 
> Thanks.
> 
> -- 
> Dmitry
> 

-- 
#gernperDu 
#CallMeByMyFirstName

Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | https://www.pengutronix.de/ |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-9    |