From nobody Fri Jul 24 05:21:21 2026 Received: from mail-pl1-f174.google.com (mail-pl1-f174.google.com [209.85.214.174]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 87E543546C0 for ; Thu, 23 Jul 2026 03:41:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.174 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784778109; cv=none; b=E23c/mBPp/VreQurj0uGt4w72d9nGC805NdXGUQU36Vpx4/4BSc7JSmNr5zbMH2Bpfm+0E18WI8WwkwCT4qzpvSzPaS6Dy3PNag/KX/51j9zKvY55EQPepFqfukpQubviciA1QLTxUF4YE/x3SeY5dvprm4w+Ew5ZMuSu+77h4s= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784778109; c=relaxed/simple; bh=Vvyncg15bJ4O7PjCkXUDVg65lNLsE5U5XJCeL2puIT4=; h=Message-ID:Date:MIME-Version:To:Cc:From:Subject:Content-Type; b=O+FVef6YvbGOScZzl7fMXzYn52ep2havPA663cv7jZHhOFdDnHyl0+nDRZRMnuTEJLs6cIsLGhil1kVQVpMe1Lou2yoOwCU6gDB/hjnQKZiUMxmJxTk3l/VOnc9SUNL77Grsq7sDCU64Ui0BfZaV1JWwzVRcorOXN9GZK41ffqE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=oLzMyBpl; arc=none smtp.client-ip=209.85.214.174 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="oLzMyBpl" Received: by mail-pl1-f174.google.com with SMTP id d9443c01a7336-2cc61541f8cso138055ad.0 for ; Wed, 22 Jul 2026 20:41:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784778107; x=1785382907; darn=vger.kernel.org; h=content-transfer-encoding:content-type:subject:from:cc:to :user-agent:mime-version:date:message-id:from:to:cc:subject:date :message-id:reply-to:content-type; bh=RClF6Xi4/ZSHQG3Aa5cQmShxSvGEjTB+8O0FFcMBNhc=; b=oLzMyBplqTQzkuUO5zysUuWsEbcJmhcKcPi7beRCbU8h2QFI47qlo9JeVnsff7GhZi NprPrc7xmGOJanbQWBg2RuD+9Da4benkfQ/5Zz/S6d62j6sEpNBT5PNMYkICaYEiIYLx uHiwFgajIxiiFvTn0PEiw543OwYLTO87a0XflXARvipp+Rx1GDZvmkxjbJrNaixrzf56 cTxZgRoKSgCNI/poEIOtgFvi+JSmJ4TYrGjgRA60G6o0XAZIlX68TVBhL6bshWcc9TcN 6E6MoEeUgN5x/RtYK8AS5eyFFSQT3+dUwLZ1VA8OgD2qJSK5nhVfY0lnhPncxZRqYZf+ W5xg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784778107; x=1785382907; h=content-transfer-encoding:content-type:subject:from:cc:to :user-agent:mime-version:date:message-id:x-gm-gg:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to:content-type; bh=RClF6Xi4/ZSHQG3Aa5cQmShxSvGEjTB+8O0FFcMBNhc=; b=iWzxtav8wqAxSxLflWiKNw1jQgE2WGJWVyEb4TfdZUGGxmYqP50Doe/o/KdO81ve8x p3WZU1g7Me4ZI9v/2l+TS1XsMuv3NfY/lcg2ldPUhxui6fkR8g7y/KYXjm7ZLZLr58vh x5FuyvwYWdOdhf+L0v8uCnILcWgwEELnJ47vkpU99sfB46+SuMm2EW8vDQ0MpfI6XIyt vaxQh3A9vbYM+ozMA1lkM3BB+rFA47ZENqgkgnT2tmHJkDKG9eZc18VtjLRDraSED6xi CdNY30Ydmwx6JRxxWwJuWzNId+rVbxhWu4XACjWfBKw6jqgFqvHe4QeCfo9mIxPObeo2 ocAg== X-Forwarded-Encrypted: i=1; AHgh+RpfwV3LnYaVGMGSBPCu+KG1DSq3zegnUFiLudSTE18IbUvW4YEhB90lTW3LqnHV3WjX68snrBVkByDggQ0=@vger.kernel.org X-Gm-Message-State: AOJu0YxmBS+fFBinpJdz/V+1Wn0z/06Hm7n844mhTouK+VCkf+01ksws aaXI8bylrJX7+LrJ+vQgX3ZJKFx/hPMam1WW0n+EA3iepZEtm7QsXA6p X-Gm-Gg: AR+sD134aD4Py2bxlxGM6+zI5Ui2ZTsEXko1RD6aml0MVKCQ04YJvV4Xn1zPnVpBhi+ qV4v2AvPWgkxw7cwJFRpn7sRG8IU0Q+Fr//RgHEL9/60k4XiZX27/ddJoKiWz1brSXxqYtE4N2K XCAOR1qxNNQoW/rYM80UfmPsKSBb7X0TvyDsIMfvM4aTj3jEjz3Mxs/UPGWwN02SPUYUN9sCCFR /m6Jn82inDBjt9GUpdemKFdPlPln2aDY4zF3bN9JuD8N6+r4p/FPJHucao2mv/Gsr99FPRV7ySP 3wyyfVIGn0D4yE80ICndDKyrmpZuKnKZNzBk11p5of+3VIAvaiO4E8nyCn2Zj8tSQ4U0Q8M0ON5 kKLccBSCoDeqFxKjrHdCpj5WQR+jGeP98rOJVT+uxYAxs4WTFRcMtFe3IYW9KCKSDpSf7tFP/hf nU1HE7e9xFrzYj8rxEdFpJW3ZRpybubg== X-Received: by 2002:a17:902:dac6:b0:2ca:eff:ff58 with SMTP id d9443c01a7336-2cfa95025a6mr10093435ad.15.1784778106597; Wed, 22 Jul 2026 20:41:46 -0700 (PDT) Received: from [192.168.228.190] ([120.236.174.211]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2cf8f310644sm24440715ad.55.2026.07.22.20.41.43 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Wed, 22 Jul 2026 20:41:46 -0700 (PDT) Message-ID: Date: Thu, 23 Jul 2026 11:41:43 +0800 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird To: dmitry.torokhov@gmail.com Cc: linux-input@vger.kernel.org, linux-kernel@vger.kernel.org From: Liang Zhan Subject: [PATCH] Input: tca8418_keypad - fix potential infinite loop and OOB, access on I2C error Content-Type: text/plain; charset="utf-8"; format="flowed" Content-Transfer-Encoding: quoted-printable From 187224ee38e19fd3f74bfc08d1908c97398fef82 Mon Sep 17 00:00:00 2001 From: Zhian Liang Date: Thu, 23 Jul 2026 00:08:15 +0800 Subject: [PATCH] Input: tca8418_keypad - fix potential infinite loop and OOB =C2=A0access on I2C error MIME-Version: 1.0 Content-Type: text/plain; charset=3DUTF-8 Content-Transfer-Encoding: 8bit If the I2C bus returns 0xFF (e.g., due to a stuck bus or device fault), the original code would treat it as a valid key event, leading to two critical issues: 1. The loop in tca8418_read_keypad() would never terminate because the =C2=A0 =C2=A0condition "reg <=3D 0" is false for 0xFF (255). This stalls t= he threaded =C2=A0 =C2=A0IRQ handler indefinitely. 2. The extracted hardware keycode (127) is used to compute row/col =C2=A0 =C2=A0indices that exceed the valid range (rows*cols =E2=89=A4 80),= causing an =C2=A0 =C2=A0out-of-bounds read on "keymap[code]" when reporting the key. Fix both by: - Recognizing 0xFF as an empty FIFO condition (along with 0x00). - Validating the keycode before calculating row/col, skipping invalid =C2=A0 codes and preventing array overrun. Cc: stable@vger.kernel.org Signed-off-by: Zhian Liang --- =C2=A0drivers/input/keyboard/tca8418_keypad.c | 11 +++++++++-- =C2=A01 file changed, 9 insertions(+), 2 deletions(-) diff --git a/drivers/input/keyboard/tca8418_keypad.c=20 b/drivers/input/keyboard/tca8418_keypad.c index b124e576feca..cec6a589192d 100644 --- a/drivers/input/keyboard/tca8418_keypad.c +++ b/drivers/input/keyboard/tca8418_keypad.c @@ -171,13 +171,20 @@ static void tca8418_read_keypad(struct=20 tca8418_keypad *keypad_data) =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 break; =C2=A0 =C2=A0 =C2=A0 =C2=A0 } - =C2=A0 =C2=A0 =C2=A0 /* Assume that key code 0 signifies empty FIFO */ - =C2=A0 =C2=A0 =C2=A0 if (reg <=3D 0) + =C2=A0 =C2=A0 =C2=A0 /* 0x00 =3D =C2=A0empty FIFO, 0xFF =3D likely bus fa= ult */ + =C2=A0 =C2=A0 =C2=A0 if (reg =3D=3D 0 || reg =3D=3D 0xFF) =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 break; =C2=A0 =C2=A0 =C2=A0 =C2=A0 state =3D reg & KEY_EVENT_VALUE; =C2=A0 =C2=A0 =C2=A0 =C2=A0 code =C2=A0=3D reg & KEY_EVENT_CODE; + =C2=A0 =C2=A0 =C2=A0 /* validate keycode: must be non-zero and within har= dware limits */ + =C2=A0 =C2=A0 =C2=A0 if (code =3D=3D 0 || code > TCA8418_MAX_ROWS * TCA84= 18_MAX_COLS){ + =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 dev_err(&keypad_data->client->dev, + =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 "invalid key code: %d\n"= , code); + =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 continue; + =C2=A0 =C2=A0 =C2=A0 } + =C2=A0 =C2=A0 =C2=A0 =C2=A0 row =3D code / TCA8418_MAX_COLS; =C2=A0 =C2=A0 =C2=A0 =C2=A0 col =3D code % TCA8418_MAX_COLS; --=20 2.34.1