Re: [PATCH] Input: tegra-kbc - check the pin numbers from the device tree

[Dmitry Torokhov]

Hi Guanglei,

On Tue, Nov 03, 2026 at 04:41:34PM +0800, Guanglei Zhu wrote:
> The row and column pin lists are read straight from the device tree
> and used to index the fixed pin configuration array:
> 
> 	num_rows = of_property_read_variable_u32_array(np, "nvidia,kbc-row-pins",
> 				rows_cfg, 1, KBC_MAX_GPIO);
> 	...
> 	for (i = 0; i < num_rows; i++) {
> 		kbc->pin_cfg[rows_cfg[i]].type = PIN_CFG_ROW;
> 		kbc->pin_cfg[rows_cfg[i]].num = i;
> 	}
> 
> The helper only limits how many entries it reads, not what they
> contain, and the pin_cfg array holds KBC_MAX_GPIO entries, so a pin
> number from the device tree indexes past the array into the rest
> of the driver data. The later configuration check validates the
> row and column counts stored this way, not the index itself, so it
> cannot undo the write.
> 
> Reject pin numbers the array does not have.
> 
> Fixes: 88390243a993 ("Input: tegra-kbc - add support for rows/columns configuration from dt")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Guanglei Zhu <zhugl3@xxxxxxxxxxxx>
> ---
>  drivers/input/keyboard/tegra-kbc.c | 8 ++++++++
>  1 file changed, 8 insertions(+)
> 
> diff --git a/drivers/input/keyboard/tegra-kbc.c b/drivers/input/keyboard/tegra-kbc.c
> index e6177f2bdf8d..f086ccf1a075 100644
> --- a/drivers/input/keyboard/tegra-kbc.c
> +++ b/drivers/input/keyboard/tegra-kbc.c
> @@ -522,6 +522,10 @@ static int tegra_kbc_parse_dt(struct tegra_kbc *kbc)
>  	}
>  
>  	for (i = 0; i < num_rows; i++) {
> +		if (rows_cfg[i] >= KBC_MAX_GPIO) {
> +			dev_err(kbc->dev, "invalid row pin %u\n", rows_cfg[i]);
> +			return -EINVAL;
> +		}
>  		kbc->pin_cfg[rows_cfg[i]].type = PIN_CFG_ROW;
>  		kbc->pin_cfg[rows_cfg[i]].num = i;
>  	}
> @@ -538,6 +542,10 @@ static int tegra_kbc_parse_dt(struct tegra_kbc *kbc)
>  	}
>  
>  	for (i = 0; i < num_cols; i++) {
> +		if (cols_cfg[i] >= KBC_MAX_GPIO) {
> +			dev_err(kbc->dev, "invalid col pin %u\n", cols_cfg[i]);
> +			return -EINVAL;
> +		}
>  		kbc->pin_cfg[cols_cfg[i]].type = PIN_CFG_COL;
>  		kbc->pin_cfg[cols_cfg[i]].num = i;
>  	}

Could you please check against kbc->num_rows_and_columns instead of
KBC_MAX_GPIO? Not all Tegra variants have 24 KBC pins (for example,
Tegra114 only has 11 rows + 8 columns = 19 pins), and the loop right
above only initializes kbc->pin_cfg[] up to kbc->num_rows_and_columns.

Thanks.

-- 
Dmitry