matrix_keypad_map_key() validates the row and column of each entry before using them to update the keymap. It does not validate the keycode before using it as a bit number in input_dev->keybit, which only has KEY_CNT bits. A malformed firmware or platform keymap can therefore write past the bitmap. Reject keycodes above KEY_MAX before updating the keymap or capability bitmap. Fixes: 77a53fd21870 ("Input: matrix-keypad - add function to build device keymap") Signed-off-by: Linmao Li <lilinmao@kylinos.cn> Link: https://patch.msgid.link/20260909100739.3107556-1-lilinmao@kylinos.cn Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>