[PATCH v3] Input: lpc32xx-keys - reject matrices bigger than the hardware has

[Guanglei Zhu]

The scanner state array holds the last state of eight matrix
columns, and the interrupt handler walks the matrix size that the
device tree declared:

	u8 lastkeystates[8];
	...
	for (i = 0; i < kscandat->matrix_sz; i++)
		lpc32xx_mod_states(kscandat, i);

The probe path only checks that rows and columns match; the
hardware supports square matrices from 1x1 up to 8x8, but nothing
stops a device tree from declaring more, which makes the state
array index run past the field into the rest of the driver data -
including the keymap pointer the same code dereferences.

Reject matrices larger than the hardware supports.

Fixes: 69690bec400e ("Input: add support for key scan interface of the LPC32xx SoC")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Guanglei Zhu <zhugl3@xxxxxxxxxxxx>
---
v3: actually include the LPC32XX_MAX_MATRIX_SIZE definition that v2
    referenced but forgot to add; compile-tested with
    CONFIG_KEYBOARD_LPC32XX enabled.

 drivers/input/keyboard/lpc32xx-keys.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/drivers/input/keyboard/lpc32xx-keys.c b/drivers/input/keyboard/lpc32xx-keys.c
index 2392e7e..b3c1dc1 100644
--- a/drivers/input/keyboard/lpc32xx-keys.c
+++ b/drivers/input/keyboard/lpc32xx-keys.c
@@ -39,6 +39,8 @@
 
 #define LPC32XX_KSCAN_DEB_NUM_DEB_PASS(n)	((n) & 0xFF)
 
+#define LPC32XX_MAX_MATRIX_SIZE		8
+
 #define LPC32XX_KSCAN_SCOND_IN_IDLE		0x0
 #define LPC32XX_KSCAN_SCOND_IN_SCANONCE		0x1
 #define LPC32XX_KSCAN_SCOND_IN_IRQGEN		0x2
@@ -65,7 +67,7 @@ struct lpc32xx_kscan_drv {
 	unsigned int row_shift;
 	unsigned short *keymap;	/* Pointer to key map for the scan matrix */
 
-	u8 lastkeystates[8];
+	u8 lastkeystates[LPC32XX_MAX_MATRIX_SIZE];
 };
 
 static void lpc32xx_mod_states(struct lpc32xx_kscan_drv *kscandat, int col)
@@ -141,6 +143,12 @@ static int lpc32xx_parse_dt(struct device *dev,
 		dev_err(dev, "rows and columns must be equal!\n");
 		return -EINVAL;
 	}
+	if (rows > LPC32XX_MAX_MATRIX_SIZE) {
+		dev_err(dev, "rows and columns must be at most %d!\n",
+			LPC32XX_MAX_MATRIX_SIZE);
+		return -EINVAL;
+	}
+
 
 	kscandat->matrix_sz = rows;
 	kscandat->row_shift = get_count_order(columns);
-- 
2.43.0