Re: [PATCH] Input: cyttsp5 - clamp the HID report size before memcpy

[Alistair]

On Tue, 2026-09-01 at 20:26 +0800, Linkai Gong wrote:
> The size field comes from the device and is used as the memcpy()
> length into response_buf, which is CY_MAX_INPUT bytes.
> 
> Fixes: 5b0c03e24a06 ("Input: Add driver for Cypress Generation 5
> touchscreen")
> Signed-off-by: Linkai Gong <gonglinkai@xxxxxxxxxx>

Reviewed-by: Alistair Francis <alistair@xxxxxxxxxxxxx>

Alistair

> ---
>  drivers/input/touchscreen/cyttsp5.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/input/touchscreen/cyttsp5.c
> b/drivers/input/touchscreen/cyttsp5.c
> index 9266c07314be..e878a02dc9b7 100644
> --- a/drivers/input/touchscreen/cyttsp5.c
> +++ b/drivers/input/touchscreen/cyttsp5.c
> @@ -710,6 +710,7 @@ static irqreturn_t cyttsp5_handle_irq(int irq,
> void *handle)
>  		size = 2;
>  	} else {
>  		report_id = ts->input_buf[2];
> +		size = min(size, CY_MAX_INPUT);
>  	}
>  
>  	switch (report_id) {