The probe path accepts `port_id == FPC202_NUM_PORTS` even though the
driver stores per-port state in `addr_caches[2][2]` and
`probed_ports` is indexed by the same range. That lets a device-tree
node with `reg = <2>` flow into `fpc202_write_dev_addr()` and
`fpc202_detach_addr()`, where the driver indexes
`addr_caches[port_id][dev_num]`.

Change the probe check to reject port ID values at or above the number
of supported ports.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
 drivers/misc/ti_fpc202.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/misc/ti_fpc202.c b/drivers/misc/ti_fpc202.c
index 8eb2b5ac9850..578feefb77f1 100644
--- a/drivers/misc/ti_fpc202.c
+++ b/drivers/misc/ti_fpc202.c
@@ -366,7 +366,7 @@ static int fpc202_probe(struct i2c_client *client)
 			goto unregister_chans;
 		}
 
-		if (port_id > FPC202_NUM_PORTS) {
+		if (port_id >= FPC202_NUM_PORTS) {
 			dev_err(dev, "port ID %d is out of range!\n", port_id);
 			ret = -EINVAL;
 			goto unregister_chans;
-- 
2.50.1 (Apple Git-155)

Hello,

On Sunday, 22 March 2026 04:19:23 CET Pengpeng Hou wrote:
> The probe path accepts `port_id == FPC202_NUM_PORTS` even though the
> driver stores per-port state in `addr_caches[2][2]` and
> `probed_ports` is indexed by the same range. That lets a device-tree
> node with `reg = <2>` flow into `fpc202_write_dev_addr()` and
> `fpc202_detach_addr()`, where the driver indexes
> `addr_caches[port_id][dev_num]`.
> 
> Change the probe check to reject port ID values at or above the number
> of supported ports.
> 
> Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
> ---
> 
>  drivers/misc/ti_fpc202.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/misc/ti_fpc202.c b/drivers/misc/ti_fpc202.c
> index 8eb2b5ac9850..578feefb77f1 100644
> --- a/drivers/misc/ti_fpc202.c
> +++ b/drivers/misc/ti_fpc202.c
> @@ -366,7 +366,7 @@ static int fpc202_probe(struct i2c_client *client)
> 
>  			goto unregister_chans;
>  		
>  		}
> 
> -		if (port_id > FPC202_NUM_PORTS) {
> +		if (port_id >= FPC202_NUM_PORTS) {

There is an existing series by Felix Gu which fixes this issue among other 
things:

https://lore.kernel.org/all/20260221-fp202-v1-0-4d28cb8b28fb@gmail.com/

I've reviewed it but I don't think it's made it into char-misc yet. Felix, 
maybe you could resend your series?

Thanks,

-- 
Romain Gantois, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com