Re: [PATCH v2] Input: lpc32xx-keys - reject matrices bigger than the hardware has

[Dmitry Torokhov]

On Wed, Nov 04, 2026 at 11:07:09AM +0800, Guanglei Zhu wrote:
> The scanner state array holds the last state of eight matrix
> columns, and the interrupt handler walks the matrix size that the
> device tree declared:
> 
> 	u8 lastkeystates[8];
> 	...
> 	for (i = 0; i < kscandat->matrix_sz; i++)
> 		lpc32xx_mod_states(kscandat, i);
> 
> The probe path only checks that rows and columns match; the
> hardware supports square matrices from 1x1 up to 8x8, but nothing
> stops a device tree from declaring more, which makes the state
> array index run past the field into the rest of the driver data -
> including the keymap pointer the same code dereferences.
> 
> Reject matrices larger than the hardware supports.
> 
> Fixes: 69690bec400e ("Input: add support for key scan interface of the LPC32xx SoC")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Guanglei Zhu <zhugl3@xxxxxxxxxxxx>
> ---
> v2: use LPC32XX_MAX_MATRIX_SIZE for the state array and the new
>     check instead of a literal 8, per review.
> 
>  drivers/input/keyboard/lpc32xx-keys.c | 8 +++++++-
>  1 file changed, 7 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/input/keyboard/lpc32xx-keys.c b/drivers/input/keyboard/lpc32xx-keys.c
> index 2392e7e..429a3eb 100644
> --- a/drivers/input/keyboard/lpc32xx-keys.c
> +++ b/drivers/input/keyboard/lpc32xx-keys.c
> @@ -65,7 +65,7 @@ struct lpc32xx_kscan_drv {
>  	unsigned int row_shift;
>  	unsigned short *keymap;	/* Pointer to key map for the scan matrix */
>  
> -	u8 lastkeystates[8];
> +	u8 lastkeystates[LPC32XX_MAX_MATRIX_SIZE];

Compiling this would be helpful...

>  };
>  
>  static void lpc32xx_mod_states(struct lpc32xx_kscan_drv *kscandat, int col)
> @@ -141,6 +141,12 @@ static int lpc32xx_parse_dt(struct device *dev,
>  		dev_err(dev, "rows and columns must be equal!\n");
>  		return -EINVAL;
>  	}
> +	if (rows > LPC32XX_MAX_MATRIX_SIZE) {
> +		dev_err(dev, "rows and columns must be at most %d!\n",
> +			LPC32XX_MAX_MATRIX_SIZE);
> +		return -EINVAL;
> +	}
> +
>  
>  	kscandat->matrix_sz = rows;
>  	kscandat->row_shift = get_count_order(columns);

-- 
Dmitry