Dmitry TorokhovandGreg Kroah-Hartman 2870cfc970 Input: mms114 - fix multi-touch slot corruption ...

commit adea84ee6c upstream.

If the touchscreen controller reports a touch ID of 0, the driver
calculates the slot ID as touch->id - 1, which underflows to UINT_MAX.
This is passed to input_mt_slot() as -1.

Since the input core ignores negative slot values, the active slot remains
unchanged. The driver then reports the touch coordinates for the previously
active slot, corrupting its state.

Fix this by rejecting touch reports with ID 0.

Fixes: 07b8481d4a ("Input: add MELFAS mms114 touchscreen driver")
Cc: stable@vger.kernel.org
Reported-by: sashiko-bot@kernel.org
Assisted-by: Antigravity:gemini-3.5-flash
Link: https://patch.msgid.link/20260704060115.353049-1-dmitry.torokhov@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2026-07-24 15:54:30 +02:00

..

88pm860x-ts.c

…

ad7877.c

…

ad7879-i2c.c

…

ad7879-spi.c

…

ad7879.c

…

ad7879.h

…

ads7846.c

Input: ads7846 - ratelimit the spi_sync error message

2024-09-18 19:23:02 +02:00

ar1021_i2c.c

…

atmel_mxt_ts.c

Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem

2026-06-19 13:37:03 +02:00

auo-pixcir-ts.c

…

bcm_iproc_tsc.c

…

bu21013_ts.c

…

bu21029_ts.c

…

chipone_icn8318.c

…

chipone_icn8505.c

…

colibri-vf50-ts.c

…

cy8ctma140.c

…

cy8ctmg110_ts.c

…

cyttsp4_core.c

minmax: don't use max() in situations that want a C constant expression

2025-10-15 11:56:21 +02:00

cyttsp4_core.h

…

cyttsp4_i2c.c

…

cyttsp4_spi.c

…

cyttsp_core.c

…

cyttsp_core.h

…

cyttsp_i2c_common.c

…

cyttsp_i2c.c

…

cyttsp_spi.c

…

da9034-ts.c

…

da9052_tsi.c

…

dynapro.c

…

edt-ft5x06.c

…

eeti_ts.c

…

egalax_ts_serial.c

…

egalax_ts.c

…

ektf2127.c

…

elants_i2c.c

…

elo.c

…

exc3000.c

…

fsl-imx25-tcq.c

…

fujitsu_ts.c

…

goodix_fwupload.c

…

goodix.c

Input: goodix - clamp the device-reported contact count

2026-07-24 15:54:30 +02:00

goodix.h

…

gunze.c

…

hampshire.c

…

hideep.c

…

hp680_ts_input.c

…

htcpen.c

…

hycon-hy46xx.c

…

ili210x.c

Input: ili210x - use kvmalloc() to allocate buffer for firmware update

2024-09-12 11:10:20 +02:00

ilitek_ts_i2c.c

Input: ilitek_ts_i2c - add report id message validation

2024-10-17 15:21:03 +02:00

imagis.c

Input: imagis - use FIELD_GET where applicable

2024-04-13 13:05:13 +02:00

imx6ul_tsc.c

…

inexio.c

…

ipaq-micro-ts.c

…

iqs5xx.c

…

jornada720_ts.c

…

Kconfig

…

lpc32xx_ts.c

…

mainstone-wm97xx.c

…

Makefile

…

max11801_ts.c

…

mc13783_ts.c

…

mcs5000_ts.c

…

melfas_mip4.c

…

migor_ts.c

…

mk712.c

…

mms114.c

Input: mms114 - fix multi-touch slot corruption

2026-07-24 15:54:30 +02:00

msg2638.c

…

mtouch.c

…

mxs-lradc-ts.c

…

pcap_ts.c

…

penmount.c

…

pixcir_i2c_ts.c

…

raspberrypi-ts.c

…

raydium_i2c_ts.c

…

resistive-adc-touch.c

…

rohm_bu21023.c

…

s3c2410_ts.c

…

s6sy761.c

…

silead.c

Input: silead - Always support 10 fingers

2024-07-25 09:49:10 +02:00

sis_i2c.c

…

st1232.c

…

stmfts.c

…

stmpe-ts.c

…

sun4i-ts.c

…

sur40.c

…

surface3_spi.c

…

sx8654.c

…

ti_am335x_tsc.c

Input: ti_am335x_tsc - fix off-by-one error in wire_order validation

2026-01-11 15:18:46 +01:00

touchit213.c

…

touchright.c

…

touchwin.c

Input: touchwin - reset the packet index on every complete packet

2026-07-24 15:54:30 +02:00

tps6507x-ts.c

…

ts4800-ts.c

…

tsc40.c

…

tsc200x-core.c

…

tsc200x-core.h

…

tsc2004.c

…

tsc2005.c

…

tsc2007_core.c

…

tsc2007_iio.c

…

tsc2007.h

…

ucb1400_ts.c

…

usbtouchscreen.c

Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size

2026-06-19 13:36:52 +02:00

wacom_i2c.c

…

wacom_w8001.c

…

wdt87xx_i2c.c

…

wm97xx-core.c

…

wm831x-ts.c

…

wm9705.c

…

wm9712.c

…

wm9713.c

…

zet6223.c

…

zforce_ts.c

…

zinitix.c

…

zylonite-wm97xx.c

…