diff options
| author | Linkai Gong <gonglinkai@kylinos.cn> | 2026-09-01 20:26:49 +0800 |
|---|---|---|
| committer | Dmitry Torokhov <dmitry.torokhov@gmail.com> | 2026-09-01 07:40:51 -0700 |
| commit | 85f080fb87ed5cd3e46121be677f52c82f26a0ab (patch) | |
| tree | 31f83ef2a8e94819b4d2ba6d17a7252bbf18b68d | |
| parent | f84819ef8d66931ee3998fee3c4f03230f4cb6cc (diff) | |
| download | linux-next-85f080fb87ed5cd3e46121be677f52c82f26a0ab.tar.gz linux-next-85f080fb87ed5cd3e46121be677f52c82f26a0ab.zip | |
Input: cyttsp5 - clamp the HID report size before memcpy
The size field comes from the device and is used as the memcpy()
length into response_buf, which is CY_MAX_INPUT bytes.
Fixes: 5b0c03e24a06 ("Input: Add driver for Cypress Generation 5 touchscreen")
Signed-off-by: Linkai Gong <gonglinkai@kylinos.cn>
Link: https://patch.msgid.link/20260901122649.1173066-1-gonglinkai@kylinos.cn
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
| -rw-r--r-- | drivers/input/touchscreen/cyttsp5.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/input/touchscreen/cyttsp5.c b/drivers/input/touchscreen/cyttsp5.c index 9266c07314be..e878a02dc9b7 100644 --- a/drivers/input/touchscreen/cyttsp5.c +++ b/drivers/input/touchscreen/cyttsp5.c @@ -710,6 +710,7 @@ static irqreturn_t cyttsp5_handle_irq(int irq, void *handle) size = 2; } else { report_id = ts->input_buf[2]; + size = min(size, CY_MAX_INPUT); } switch (report_id) { |