github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-06 21:58:01 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

leds: pca9532: Check i2c_smbus_read_byte_data() return value

Browse Source 
Coverity report INTEGER_OVERFLOW (tainted_data_return ->
cast_underflow -> overflow) in pca9532_getled().
pca9532_getled() stored the return value of i2c_smbus_read_byte_data()
into a char and used it directly to compute the LED state without
checking for an error. i2c_smbus_read_byte_data() returns a negative
error code on failure. On an I2C read error the negative value was
assigned to an unsigned type, triggering an integer underflow/overflow,
and a meaningless LED state was returned to the caller.

Read the value into an int, check for the error, and fall back to
PCA9532_OFF while emitting a warning when the read fails.

Fixes: 28c5fe9901 ("leds: pca9532: Extend pca9532 device tree support")
Assisted-by: VeroCoder:vero-1 [cli]
Signed-off-by: Haibo Chen <haibo.chen@nxp.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260727-led-fix-v1-1-d635c5037109@nxp.com
Signed-off-by: Lee Jones <lee@kernel.org>
This commit is contained in:
Haibo Chen 2026-07-27 17:57:54 +08:00 committed by Lee Jones
parent c73e9f0444
commit 1b75f038e5
1 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
drivers/leds/leds-pca9532.c
View File

@ -298,12 +298,15 @@ static enum pca9532_state pca9532_getled(struct pca9532_led *led)
struct i2c_client *client = led->client;
struct pca9532_data *data = i2c_get_clientdata(client);
u8 maxleds = data->chip_info->num_leds;
char reg;
enum pca9532_state ret;
int reg;
enum pca9532_state ret = PCA9532_OFF;
mutex_lock(&data->update_lock);
reg = i2c_smbus_read_byte_data(client, LED_REG(maxleds, led->id));
ret = (reg & LED_MASK(led->id)) >> LED_SHIFT(led->id);
if (reg >= 0)
ret = (reg & LED_MASK(led->id)) >> LED_SHIFT(led->id);
else
dev_warn(&client->dev, "failed to read LED register: %d\n", reg);
mutex_unlock(&data->update_lock);
return ret;
}