On 3/29/2012 2:58 AM, Stephen Warren wrote:

so the DT parsing can easily overflow this, and is driven by
user-supplied data.

Got it. This check is must.

I think you'll need to pass input_dev->keycodesize

you mean keycodemax here?

into matrix_keypad_of_build_keymap() to achieve the overall
range-checking.

Will do that.

but also checking col against (1<<row_shift) would be
needed to make sure the individual "fields" of the array index don't
overflow too.

Ok. Please cross check V3 to verify, i got you comments correctly.

-- 
viresh