Re: [PATCH v1] Input: rmi4 - fix out-of-bounds write in rmi_set_page

From: Wei Jie Law

Date: Mon Aug 24 2026 - 01:55:31 EST


Superseded by v2:
https://lore.kernel.org/linux-input/00a489f38b240624dcb5a4bae36a53fcba9cfb47.1787549195.git.98lawweijie@xxxxxxxxx/

v1's commit message claims rmi_set_page() writes one byte past the
allocation. That is wrong on any kernel since v6.1 -- check_dr_size()
rounds the devres allocation up to the whole kmalloc bucket, so
devm_kzalloc(4) is a 64-byte kmalloc and that store is in bounds. v2
corrects the reasoning and adds one more fix to the same loop.