From nobody Fri Aug 14 15:50:33 2026 Received: from mail-pl1-f172.google.com (mail-pl1-f172.google.com [209.85.214.172]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DDF8B3D093A for ; Fri, 14 Aug 2026 13:39:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.172 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786714802; cv=none; b=o9lcgQjvAaYZacPHdk5O1Py4R9O2UIKJPrv9vtaLp8X9pYGQAKUOR5sztTvr1hFwyMOt6n1Mc6EkHnuxmtDgvZrNdTL6WJ/Ym8BSqUJw5tW2Fe71uD2I/8hbCovwFZ1PUOeNszZWuLMMPusdFiPcwCjZtl70vrPlMHtZ0oM6ubg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786714802; c=relaxed/simple; bh=tZXvOI4VwFoWHHD7uTMP+/FnLH3DDWy/Ly6lnOXaNWc=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=qa0Kq9YPax9rGi7zurHoPfYqId4RjNxci9thzsAfoLThaZkMdLmADa+wH1AVBG4urf8X1Dx3Hoe8Bjtp3Xyu5FIKOsz8CSU2faIhFNSpe+o66SSFQKXM02gYlyW7D1aQPELRnejoI3pB/fFYk0pys97ndV0oQoPCbTw/cc5ho5k= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=ZSvJ7xNH; arc=none smtp.client-ip=209.85.214.172 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="ZSvJ7xNH" Received: by mail-pl1-f172.google.com with SMTP id d9443c01a7336-2cc61541f8cso27001545ad.0 for ; Fri, 14 Aug 2026 06:39:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786714799; x=1787319599; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=jFlMnEpfoNO0V7ZJ+JnOg/5mm8WDZWgSDP9SMNfE/Ss=; b=ZSvJ7xNHjFkWW3b9n9BsS+xsBIiJAzzIkYf7SSKJh04XUmk4dMRv9HwVwYAGQCH2Dc BwNaj/Py0wIzipuqAZiyTl2IKqlJdQV/MP9J7O+2DQ8wBZczNVU4j2jC7ixljQESlzE7 dn93N766CWToDR3KqiVk9NecntKsmoD8PwlyHzwzwSkmvjB5Lh90PVxJiTEcvEspNFl2 Qar10N1Uftmc1j1aH6KQ4Wlqb2Aak9q83QNOxnxnTBD151/gJfCe24fsiRvmGDM8BRbB RFJtA7gH7eKWfDN82wWmrogwSH89idwGZPDfWnlw+/EvrPVTXeRJWaqC2fGu8GnoFuKZ nOiw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786714799; x=1787319599; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=jFlMnEpfoNO0V7ZJ+JnOg/5mm8WDZWgSDP9SMNfE/Ss=; b=XBpkv/wUXTvjm+o+eew4AaJs21QdMvN9b0WKwO7NS9oY7QXVPfhyCMQJJGNaJ3lJ7i iCXHmWR0mWqPFCip8GWdkFIwOFKbDiGQQ/W6gZQ0VFY8EciI7fW6MRIll+AD6mT2Os91 6fMGwwYafe30FAOywuEguEpQM1E3BW0euuX8fdlCfPBt/URtfVSDVPv7TCyhcxhL5NoY gZJhL+OpcZZxa/vZLoO9VIBsCJCwq4J4c0MtMRqJ0uNhmilPfm/5Wqihw1KZWKHWH4GG vLMZFbYnA1bJ9KxQn4+horAmunUeuuy8BfD2+f7jA6LIpMgjTlYlrPgIN/O97JJpo/83 67oQ== X-Forwarded-Encrypted: i=1; AHgh+RqknwP89/AiUap/aGGE4B/RLyzinjK+KeB0qAphcC5mjs/yvD0xPE3WFfvld0QbHNjfFsZT5NYJYaB7K7Q=@vger.kernel.org X-Gm-Message-State: AOJu0Yx6myQhUaouWrVfvg6zJX8xA+ZyTuMY93Y5R1vbgG+zNA6i0vCX 5M0+gGh8uk4zi+6AdME/UmTEOq4ZicvYEiwjXY2y+ZKImIasjqtNlOlL X-Gm-Gg: AR+sD13C8X7lHVq4xaFkxCAdhOB598a4RTsnaCJ3BpTRxT6VbszufsKMrPpnn+1cxsU rFyTVPgIfQPlo8Vq3a58n0k0TNMFhXlLlrNljI5pW1xSc3k+0Plex1h9N8lIcHFEtouA2s8keOk ctITwqCDxA3NEHqaNbXKGG4IkBGJ165R4+s0t4gaZCatc1MCrbvrk0mbWfvKRcwAdiMejCN7Gng szTl8outzrsvDGVwCQaPi2AvRS+DBF6+kS/TnOZIOlMOPoYm6TwvWhfzcxQzCWXMlegyulCx7gW hc6SuUrWvQBk+zAxWL2ybbRnZlDBTNxauGlJKjfJl0/rLf3mW96VAT8spLbBTwc3fhm6juU+rRp rElhDpxMLnJcvk4xhqxCK4945OZG6RHhSGOoTn1HQi324QnRKRAarqg1fg0RyldWlt/a4QUc3FM W04ahnwiglQWlfgtSMiMiWtHuDYkiN1N585CymUlvSw89007VpK5j4ZndOBU8u5QgNMptPSc6Ac kWUlFrulQ3RQA== X-Received: by 2002:a17:903:285:b0:2cc:841d:cd7e with SMTP id d9443c01a7336-2d3b009a1efmr52582635ad.21.1786714799102; Fri, 14 Aug 2026 06:39:59 -0700 (PDT) Received: from haichao.tail057a43.ts.net ([2001:da8:e000:1206:e9af:7c0e:be31:2c3f]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2d3aeb271acsm9717535ad.52.2026.08.14.06.39.54 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 14 Aug 2026 06:39:58 -0700 (PDT) From: Ruoyu Wang To: Russell King , Andrzej Hajda , Neil Armstrong , Robert Foss , Laurent Pinchart , Jonas Karlman , Jernej Skrabec , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Brian Starkey Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, Ruoyu Wang Subject: [PATCH] drm/bridge: tda998x: Handle short CEC register reads Date: Fri, 14 Aug 2026 21:39:52 +0800 Message-ID: <20260814133952.1386158-1-ruoyuw560@gmail.com> X-Mailer: git-send-email 2.51.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" cec_read() uses a two-message I2C transfer to select a register and read its value. i2c_transfer() returns a negative errno or the number of messages executed. A short transfer can therefore return zero or one without writing the second message's buffer. The current negative-only check treats that as success and returns an uninitialized stack byte. The value may then affect register read-modify-write operations, interrupt and HPD handling, or connector detection. Require both messages to complete before using the byte. Preserve the existing zero fallback for failed reads. This issue was found by a static analysis checker and confirmed by manual source review. Fixes: 14e5b5889d75 ("drm/i2c: tda998x: allow sharing of the CEC device acc= esses") Signed-off-by: Ruoyu Wang --- drivers/gpu/drm/bridge/tda998x_drv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/bridge/tda998x_drv.c b/drivers/gpu/drm/bridge/= tda998x_drv.c index 6c427bc75896b..7e82c918277fa 100644 --- a/drivers/gpu/drm/bridge/tda998x_drv.c +++ b/drivers/gpu/drm/bridge/tda998x_drv.c @@ -438,7 +438,7 @@ cec_read(struct tda998x_priv *priv, u8 addr) int ret; =20 ret =3D i2c_transfer(priv->hdmi->adapter, msg, ARRAY_SIZE(msg)); - if (ret < 0) { + if (ret !=3D ARRAY_SIZE(msg)) { dev_err(&priv->hdmi->dev, "Error %d reading from cec:0x%x\n", ret, addr); val =3D 0; --=20 2.51.0