diff options
| author | Ariel Silver <arielsilver77@gmail.com> | 2026-02-20 11:44:28 +0300 |
|---|---|---|
| committer | Dmitry Torokhov <dmitry.torokhov@gmail.com> | 2026-03-01 05:16:35 +0300 |
| commit | 0c695e6b90674c67e03866123456cabfe1f74d9c (patch) | |
| tree | a74fbdd7b1e93169e5e300be48822a0bc07deb80 /include/linux/stacktrace.h | |
| parent | 4410a3f14c305de493036b7d982f24b84e4c8e03 (diff) | |
| download | linux-0c695e6b90674c67e03866123456cabfe1f74d9c.tar.xz | |
Input: atkbd - validate scancode in firmware keymap entries
The SCANCODE() macro extracts a 16-bit value (0..65535) from firmware
device property data, but atkbd_get_keymap_from_fwnode() uses it
directly to index atkbd->keycode[], which only has ATKBD_KEYMAP_SIZE
(512) elements. A firmware-supplied scancode >= 512 causes a heap
out-of-bounds write that can corrupt adjacent struct atkbd fields and
neighboring slab objects.
Add a bounds check that rejects the entire firmware keymap if any entry
contains an out-of-range scancode, consistent with the validation
performed by matrix_keypad_parse_keymap() in drivers/input/matrix-keymap.c
for the same "linux,keymap" property format. When rejected, the driver
falls back to the default keycode table.
Fixes: 9d17ad2369dc ("Input: atkbd - receive and use physcode->keycode mapping from FW")
Signed-off-by: Ariel Silver <arielsilver77@gmail.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Diffstat (limited to 'include/linux/stacktrace.h')
0 files changed, 0 insertions, 0 deletions