Re: [PATCH] Input: raspberrypi-ts - reject out-of-range point counts and slot IDs
From: Dave Stevenson <dave.stevenson@raspberrypi.com>
Date: 2026-08-20 17:43:23
Also in:
linux-arm-kernel, lkml, stable
Hi Linkai On Thu, 20 Aug 2026 at 08:29, Linkai Gong [off-list ref] wrote:
rpi_ts_poll() copies a firmware snapshot and walks regs.point[] using num_points. The array has RPI_TS_MAX_SUPPORTED_POINTS entries, and the GPU is documented to report 0-10 points (99 invalidates the copy). A corrupted count would index past that snapshot. Slot IDs are a 4-bit field (0-15) while only 10 MT slots are allocated. Drop the whole frame instead of clamping, so a bad report cannot update a subset of contacts.
This touch driver is only used with the original Pi DSI display when used with the legacy, firmware driven, display stack. Raspberry Pi have considered that display stack deprecated for at least 4 years. Our guidance is to use the edt-ft5x06 driver alongside the vc4 DRM driver. TBH I'd support dropping this driver entirely. Will anyone object if I send a patch to do that?
quoted hunk ↗ jump to hunk
Fixes: 0b9f28fed3f7 ("Input: add official Raspberry Pi's touchscreen driver") Cc: stable@vger.kernel.org Signed-off-by: Linkai Gong <redacted> --- drivers/input/touchscreen/raspberrypi-ts.c | 4 ++++ 1 file changed, 4 insertions(+)diff --git a/drivers/input/touchscreen/raspberrypi-ts.c b/drivers/input/touchscreen/raspberrypi-ts.c index 841d39a449b3..bd63d95c094b 100644 --- a/drivers/input/touchscreen/raspberrypi-ts.c +++ b/drivers/input/touchscreen/raspberrypi-ts.c@@ -78,6 +78,7 @@ static void rpi_ts_poll(struct input_dev *input) ts->fw_regs_va + offsetof(struct rpi_ts_regs, num_points)); if (regs.num_points == RPI_TS_NPOINTS_REG_INVALIDATE || + regs.num_points > RPI_TS_MAX_SUPPORTED_POINTS || (regs.num_points == 0 && ts->known_ids == 0)) return;@@ -87,6 +88,9 @@ static void rpi_ts_poll(struct input_dev *input) touchid = (regs.point[i].yh >> 4) & 0xf; event_type = (regs.point[i].xh >> 6) & 0x03; + if (touchid >= RPI_TS_MAX_SUPPORTED_POINTS) + return; +
Can you just abort here? If this was with i > 0 then there has already been 1 or more input_mt_slot(), input_mt_report_slot_state(), and touchscreen_report_pos() calls which update the device state. True input_mt_sync_frame() / input_sync() haven't been called to report the event to userspace, but my gut feel is that the next poll won't necessarily reset those events in the device state. I'm happy to be corrected by someone who knows the input subsystem better. Dave
modified_ids |= BIT(touchid);
if (event_type == RPI_TS_FTS_TOUCH_DOWN ||
--
2.25.1