Re: [PATCH] Input: mt6779-keypad - check the reported row and column

[Dmitry Torokhov]

On Tue, Nov 03, 2026 at 04:41:33PM +0800, Guanglei Zhu wrote:
> The interrupt handler turns register bits into a matrix position
> and indexes the keycode array with it:
> 
> 		keypad->calc_row_col(key, &row, &col);
> 
> 		scancode = MATRIX_SCAN_CODE(row, col, row_shift);
> 		...
> 		input_report_key(keypad->input_dev, keycode[scancode], pressed);
> 
> The keycode array is sized after the rows and columns the device
> tree declared, but neither the probe nor the handler checks that a
> reported position actually fits those dimensions. A register glitch
> or a matrix smaller than the hardware's fixed layout indexes past
> the array and reports whatever sits there as a key code.
> 
> Skip positions outside the declared matrix.
> 
> Fixes: f28af984e771 ("Input: mt6779-keypad - add MediaTek keypad driver")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Guanglei Zhu <zhugl3@xxxxxxxxxxxx>

Applied, thank you.

-- 
Dmitry