Re: [PATCH] Input: cyapa_gen3 - clamp the reported finger count to the array

[Dmitry Torokhov]

Hi Guanglei,

On Tue, Nov 03, 2026 at 04:41:35PM +0800, Guanglei Zhu wrote:
> The finger count is taken from the top nibble of a status byte the
> trackpad firmware fills in, and used to walk the touch array:
>
> 	num_fingers = (data->finger_btn >> 4) & 0x0f;
> 	for (i = 0; i < num_fingers; i++) {
> 		const struct cyapa_touch *touch = &data->touches[i];
>
> The nibble allows up to fifteen fingers, but the array holds the
> five touches the chip is documented to report, so a firmware that
> counts beyond that makes the driver report coordinates read from
> the stack past the register block.
>
> Clamp the finger count to the size of the array.
>
> Fixes: 9f1cd857518f ("Input: cyapa - re-design driver to support multi-trackpad in one driver")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Guanglei Zhu <zhugl3@xxxxxxxxxxxx>
> ---
>  drivers/input/mouse/cyapa_gen3.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/input/mouse/cyapa_gen3.c b/drivers/input/mouse/cyapa_gen3.c
> index fc3fb954523b..fda807a4c141 100644
> --- a/drivers/input/mouse/cyapa_gen3.c
> +++ b/drivers/input/mouse/cyapa_gen3.c
> @@ -1149,7 +1149,8 @@ static int cyapa_gen3_event_process(struct cyapa *cyapa,
>  	int num_fingers;
>  	int i;
>  
> -	num_fingers = (data->finger_btn >> 4) & 0x0f;
> +	num_fingers = min((data->finger_btn >> 4) & 0x0f,
> +			  ARRAY_SIZE(data->touches));
>  	for (i = 0; i < num_fingers; i++) {
>  		const struct cyapa_touch *touch = &data->touches[i];
>  		/* Note: touch->id range is 1 to 15; slots are 0 to 14. */

If the packet reports more than 5 fingers (for example, if an I2C read
glitches and returns 0xff bytes, which would otherwise pass the bit
checks for OP_STATUS_SRC, CYAPA_DEV_NORMAL, and OP_DATA_VALID), the
packet is corrupted and we should not clamp the count and report 5 bogus
touches to userspace.

Instead, please reject packets reporting more than GEN3_MAX_FINGERS
with -EINVAL during the header validation in cyapa_gen3_irq_handler()
and cyapa_gen3_try_poll_handler() (or in cyapa_gen3_event_process()),
so the driver treats it as an invalid state and reinitializes the
device. While at it, please also use GEN3_MAX_FINGERS to size
data->touches[] in struct cyapa_reg_data, and either fix
GEN3_FINGER_NUM() to mask with 0x0f and use it, or drop the unused
macro.

Thanks.

-- 
Dmitry