Re: [PATCH] Input: hynitron-cst816x - ignore unsupported gestures

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The driver passes stack-allocated variables (`tch` and `reg`) as buffers to `i2c_transfer()`. Since stack memory in modern kernels is mapped in virtual memory (VMAP_STACK) and is not guaranteed to be physically contiguous or DMA-safe, this may cause a kernel panic or silent memory corruption if the underlying I2C adapter attempts to use DMA.
--

--- Patch [1]: [PATCH] Input: hynitron-cst816x - ignore unsupported gestures ---
commit ac0089fd4854af750c6a0b96cd68ac7ac4980ba9
Author: Jianing Li <[email protected]>

Input: hynitron-cst816x - ignore unsupported gestures

This commit modifies the CST816x touchscreen driver to ignore unsupported
gesture IDs. It returns an invalid slot for unsupported gestures and checks
it against the configured keycodes before reporting the event.

> diff --git a/drivers/input/touchscreen/hynitron-cst816x.c b/drivers/input/touchscreen/hynitron-cst816x.c
> index 47d9cd7412d1b..d0668ac96f9af 100644
> --- a/drivers/input/touchscreen/hynitron-cst816x.c
> +++ b/drivers/input/touchscreen/hynitron-cst816x.c

[ ... ]

> @@ -169,6 +164,7 @@ static irqreturn_t cst816x_irq_cb(int irq, void *cookie)
>  {
>  	struct cst816x_priv *priv = cookie;
>  	struct cst816x_touch tch;
> +	unsigned int gest_idx;
>  
>  	if (!cst816x_process_touch(priv, &tch))

[Severity: High]
This is a pre-existing issue, but are stack allocated variables safely
passed to i2c_transfer() here?

The local variable `tch` is allocated on the stack and passed to
cst816x_process_touch(), which then passes it to cst816x_i2c_read_register():

drivers/input/touchscreen/hynitron-cst816x.c:cst816x_i2c_read_register() {
	struct i2c_msg xfer[] = {
		{
			.addr = priv->client->addr,
			.flags = 0,
			.buf = &reg,
			.len = sizeof(reg),
		},
		{
			.addr = priv->client->addr,
			.flags = I2C_M_RD,
			.buf = buf,
			.len = len,
		},
	};
	...
	ret = i2c_transfer(priv->client->adapter, xfer, ARRAY_SIZE(xfer));
	...
}

Because stack memory can be mapped in virtual memory (VMAP_STACK), it is
not guaranteed to be physically contiguous or DMA-safe.

If the underlying I2C adapter uses DMA, passing `&reg` or `buf` (pointing
to `tch`) could cause a kernel panic or silent memory corruption.

>  		return IRQ_HANDLED;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1