Re: [PATCH v1] Input: rmi4 - fix out-of-bounds write in rmi_set_page
Wei Jie Law <[email protected]>
| Newsgroups | org.kernel.vger.linux-kernel,org.kernel.vger.linux-input |
|---|---|
| Message-ID | <[email protected]> |
Superseded by v2: https://lore.kernel.org/linux-input/00a489f38b240624dcb5a4bae36a53fcba9cfb47.1787549195.git.98lawweijie@gmail.com/ v1's commit message claims rmi_set_page() writes one byte past the allocation. That is wrong on any kernel since v6.1 -- check_dr_size() rounds the devres allocation up to the whole kmalloc bucket, so devm_kzalloc(4) is a 64-byte kmalloc and that store is in bounds. v2 corrects the reasoning and adds one more fix to the same loop.