kernel/linux.git/drivers/input/touchscreen/usbtouchscreen.c, branch v7.0.12

Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size

2026-06-09T10:32:19+00:00

commit 2905281cbda52ec9df540113b35b835feb5fafd3 upstream. nexio_read_data() pulls data_len and x_len from a packed __be16 header in the device's interrupt packet and then walks packet->data[0..x_len) and packet->data[x_len..data_len) comparing each byte against a threshold. Both fields are 16-bit on the wire (max 65535). The existing adjustments shave at most 0x100 / 0x80 off, so the loop bound can still reach roughly 0xfeff. The URB transfer buffer for NEXIO is rept_size (1024) bytes from usb_alloc_coherent(), with the first 7 occupied by the packed header — so packet->data[] has 1017 valid bytes. read_data() callbacks are not given urb->actual_length, and nothing else bounds the walk. A device that lies about its length can get a ~64 KiB out-of-bounds read past the coherent DMA allocation. The first index whose byte exceeds NEXIO_THRESHOLD lands in begin_x / begin_y and from there into the reported touch coordinates, so adjacent kernel memory contents leak to userspace as ABS_X / ABS_Y events. Far enough out, the read can also hit an unmapped page and fault. Fix this all by clamping data_len to the buffer's data[] capacity and x_len to data_len. Cc: Dmitry Torokhov Fixes: 5197424cdccc ("Input: usbtouchscreen - add NEXIO (or iNexio) support") Cc: stable Assisted-by: gkh_clanker_t1000 Signed-off-by: Greg Kroah-Hartman Link: https://patch.msgid.link/2026042026-chlorine-epidermis-fd6d@gregkh Signed-off-by: Dmitry Torokhov Signed-off-by: Greg Kroah-Hartman

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-22T01:09:51+00:00

This was done entirely with mindless brute force, using git grep -l '\

treewide: Replace kmalloc with kmalloc_obj for non-scalar types

2026-02-21T09:02:28+00:00

This is the result of running the Coccinelle script from scripts/coccinelle/api/kmalloc_objs.cocci. The script is designed to avoid scalar types (which need careful case-by-case checking), and instead replace kmalloc-family calls that allocate struct or union object instances: Single allocations: kmalloc(sizeof(TYPE), ...) are replaced with: kmalloc_obj(TYPE, ...) Array allocations: kmalloc_array(COUNT, sizeof(TYPE), ...) are replaced with: kmalloc_objs(TYPE, COUNT, ...) Flex array allocations: kmalloc(struct_size(PTR, FAM, COUNT), ...) are replaced with: kmalloc_flex(*PTR, FAM, COUNT, ...) (where TYPE may also be *VAR) The resulting allocations no longer return "void *", instead returning "TYPE *". Signed-off-by: Kees Cook

Input: usbtouchscreen - switch to using __free() cleanup facility

2024-07-16T01:07:39+00:00

Use __free(kfree) cleanup facility when allocating temporary buffers for USB transfers. Reviewed-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20240712051851.3463657-8-dmitry.torokhov@gmail.com Signed-off-by: Dmitry Torokhov

Input: usbtouchscreen - use guard notation when acquiring mutexes

2024-07-16T01:07:39+00:00

This makes the code more compact and error handling more robust. Reviewed-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20240712051851.3463657-7-dmitry.torokhov@gmail.com Signed-off-by: Dmitry Torokhov

Input: usbtouchscreen - split device info table into individual pieces

2024-07-16T01:07:38+00:00

Instead of using a single table containing information about various touchscreens and enums to match the driver ID table data with chip information define individual per-protocol instances of usbtouch_device_info structure and reference them directly from the usbtouch_devices ID table. This is simpler, safer, and uses less memory in case some protocols are disabled. Reviewed-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20240712051851.3463657-6-dmitry.torokhov@gmail.com Signed-off-by: Dmitry Torokhov

Input: usbtouchscreen - constify usbtouch_dev_info table

2024-07-16T01:07:38+00:00

The data in this table is shared between all instances of the touchscreens so it should not be modified. Reviewed-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20240712051851.3463657-5-dmitry.torokhov@gmail.com Signed-off-by: Dmitry Torokhov

Input: usbtouchscreen - move process_pkt() into main device structure

2024-07-16T01:07:38+00:00

In preparation of splitting big usbtouch_dev_info table into separate per-protocol structures and constifying them move process_pkt() from the device info into main drvice structure and set it up in probe(). We can derive if we should use single- or multi-packet handling based on presence of get_pkt_len() method. Reviewed-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20240712051851.3463657-4-dmitry.torokhov@gmail.com Signed-off-by: Dmitry Torokhov

Input: usbtouchscreen - move the driver ID table

2024-07-16T01:07:38+00:00

Move the driver's ID table closer to where it is used in preparation to it using pointers to device info/parameters instead of device type enum. Reviewed-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20240712051851.3463657-3-dmitry.torokhov@gmail.com Signed-off-by: Dmitry Torokhov

Input: usbtouchscreen - remove custom USB_DEVICE_HID_CLASS macro

2024-07-16T01:07:38+00:00

There already exists perfectly suitable USB_DEVICE_INTERFACE_CLASS macro, use it. Reviewed-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20240712051851.3463657-2-dmitry.torokhov@gmail.com Signed-off-by: Dmitry Torokhov