Skip to content

Commit d89daea

Browse files
dtorgregkh
authored andcommitted
Input: mms114 - fix multi-touch slot corruption
commit adea84e upstream. If the touchscreen controller reports a touch ID of 0, the driver calculates the slot ID as touch->id - 1, which underflows to UINT_MAX. This is passed to input_mt_slot() as -1. Since the input core ignores negative slot values, the active slot remains unchanged. The driver then reports the touch coordinates for the previously active slot, corrupting its state. Fix this by rejecting touch reports with ID 0. Fixes: 07b8481 ("Input: add MELFAS mms114 touchscreen driver") Cc: stable@vger.kernel.org Reported-by: sashiko-bot@kernel.org Assisted-by: Antigravity:gemini-3.5-flash Link: https://patch.msgid.link/20260704060115.353049-1-dmitry.torokhov@gmail.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
1 parent a72f944 commit d89daea

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

drivers/input/touchscreen/mms114.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -165,7 +165,7 @@ static void mms114_process_mt(struct mms114_data *data, struct mms114_touch *tou
165165
unsigned int x;
166166
unsigned int y;
167167

168-
if (touch->id > MMS114_MAX_TOUCH) {
168+
if (touch->id == 0 || touch->id > MMS114_MAX_TOUCH) {
169169
dev_err(&client->dev, "Wrong touch id (%d)\n", touch->id);
170170
return;
171171
}

0 commit comments

Comments
 (0)