Re: [PATCH v2 1/2] Input: synaptics-rmi4 - fix irq[] overrun with 7 interrupt sources
From: sashiko-bot@kernel.org
Date: 2026-08-24 12:42:19
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: Pre-existing issues: - [High] Missing error check for `irq_create_mapping()` return value. --
--- Patch [1]: [PATCH v2 1/2] Input: synaptics-rmi4 - fix irq[] overrun with 7 interrupt sources ---commit 8ffaede8e39380dc2ce433141763af42eefb7d4a Author: Wei Jie Law [off-list ref] Input: synaptics-rmi4 - fix irq[] overrun with 7 interrupt sources The commit fixes an out-of-bounds array access in the rmi4 driver by increasing RMI_FN_MAX_IRQS from 6 to 7. A device can legitimately declare up to 7 interrupt sources, causing the driver to overwrite memory when indexing the irq array.
quoted hunk ↗ jump to hunk
diff --git a/drivers/input/rmi4/rmi_bus.h b/drivers/input/rmi4/rmi_bus.h index 90122df21f746..faf2ebb00d521 100644 --- a/drivers/input/rmi4/rmi_bus.h +++ b/drivers/input/rmi4/rmi_bus.h@@ -12,10 +12,13 @@
[ ... ]
-#define RMI_FN_MAX_IRQS 6 +#define RMI_FN_MAX_IRQS 7
[Severity: High]
This isn't a bug introduced by this patch, but I noticed a potential problem
in how the interrupts are mapped in rmi_create_function_irq().
drivers/input/rmi4/rmi_bus.c:rmi_create_function_irq() {
...
fn->irq[i] = irq_create_mapping(drvdata->irqdomain,
fn->irq_pos + i);
irq_set_chip_data(fn->irq[i], fn);
irq_set_chip_and_handler(fn->irq[i], &rmi_irq_chip,
handle_simple_irq);
...
}
Does this code need to check if irq_create_mapping() returns 0?
If memory allocation fails or the IRQ domain is exhausted during device probe,
it seems we might pass 0 directly to irq_set_chip_data() and
irq_set_chip_and_handler().
On architectures where IRQ 0 is a valid and critical system interrupt, like
the x86 system timer, could overwriting the descriptor cause system
instability?
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260824122733.76321-1-98lawweijie@gmail.com?part=1