From 187224ee38e19fd3f74bfc08d1908c97398fef82 Mon Sep 17 00:00:00 2001
From: Zhian Liang <liangzhan5dev@gmail.com>
Date: Thu, 23 Jul 2026 00:08:15 +0800
Subject: [PATCH] Input: tca8418_keypad - fix potential infinite loop and OOB
access on I2C error
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
If the I2C bus returns 0xFF (e.g., due to a stuck bus or device fault),
the original code would treat it as a valid key event, leading to two
critical issues:
1. The loop in tca8418_read_keypad() would never terminate because the
condition "reg <= 0" is false for 0xFF (255). This stalls the threaded
IRQ handler indefinitely.
2. The extracted hardware keycode (127) is used to compute row/col
indices that exceed the valid range (rows*cols ≤ 80), causing an
out-of-bounds read on "keymap[code]" when reporting the key.
Fix both by:
- Recognizing 0xFF as an empty FIFO condition (along with 0x00).
- Validating the keycode before calculating row/col, skipping invalid
codes and preventing array overrun.
Cc: stable@vger.kernel.org
Signed-off-by: Zhian Liang <liangzhan5dev@gmail.com>
---
drivers/input/keyboard/tca8418_keypad.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/drivers/input/keyboard/tca8418_keypad.c
b/drivers/input/keyboard/tca8418_keypad.c
index b124e576feca..cec6a589192d 100644
--- a/drivers/input/keyboard/tca8418_keypad.c
+++ b/drivers/input/keyboard/tca8418_keypad.c
@@ -171,13 +171,20 @@ static void tca8418_read_keypad(struct
tca8418_keypad *keypad_data)
break;
}
- /* Assume that key code 0 signifies empty FIFO */
- if (reg <= 0)
+ /* 0x00 = empty FIFO, 0xFF = likely bus fault */
+ if (reg == 0 || reg == 0xFF)
break;
state = reg & KEY_EVENT_VALUE;
code = reg & KEY_EVENT_CODE;
+ /* validate keycode: must be non-zero and within hardware limits */
+ if (code == 0 || code > TCA8418_MAX_ROWS * TCA8418_MAX_COLS){
+ dev_err(&keypad_data->client->dev,
+ "invalid key code: %d\n", code);
+ continue;
+ }
+
row = code / TCA8418_MAX_COLS;
col = code % TCA8418_MAX_COLS;
--
2.34.1