The scanner state array holds the last state of eight matrix columns, and the interrupt handler walks the matrix size that the device tree declared: u8 lastkeystates[8]; ... for (i = 0; i < kscandat->matrix_sz; i++) lpc32xx_mod_states(kscandat, i); The probe path only checks that rows and columns match; the hardware supports square matrices from 1x1 up to 8x8, but nothing stops a device tree from declaring more, which makes the state array index run past the field into the rest of the driver data - including the keymap pointer the same code dereferences. Reject matrices larger than the hardware supports. Fixes: 69690bec400e ("Input: add support for key scan interface of the LPC32xx SoC") Cc: stable@vger.kernel.org Signed-off-by: Guanglei Zhu --- v2: use LPC32XX_MAX_MATRIX_SIZE for the state array and the new check instead of a literal 8, per review. drivers/input/keyboard/lpc32xx-keys.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/input/keyboard/lpc32xx-keys.c b/drivers/input/keyboard/lpc32xx-keys.c index 2392e7e..429a3eb 100644 --- a/drivers/input/keyboard/lpc32xx-keys.c +++ b/drivers/input/keyboard/lpc32xx-keys.c @@ -65,7 +65,7 @@ struct lpc32xx_kscan_drv { unsigned int row_shift; unsigned short *keymap; /* Pointer to key map for the scan matrix */ - u8 lastkeystates[8]; + u8 lastkeystates[LPC32XX_MAX_MATRIX_SIZE]; }; static void lpc32xx_mod_states(struct lpc32xx_kscan_drv *kscandat, int col) @@ -141,6 +141,12 @@ static int lpc32xx_parse_dt(struct device *dev, dev_err(dev, "rows and columns must be equal!\n"); return -EINVAL; } + if (rows > LPC32XX_MAX_MATRIX_SIZE) { + dev_err(dev, "rows and columns must be at most %d!\n", + LPC32XX_MAX_MATRIX_SIZE); + return -EINVAL; + } + kscandat->matrix_sz = rows; kscandat->row_shift = get_count_order(columns); -- 2.43.0