From 1b75f038e5f71ed32ce6593b5763f9776ec58a25 Mon Sep 17 00:00:00 2001 From: Haibo Chen Date: Mon, 27 Jul 2026 17:57:54 +0800 Subject: [PATCH] leds: pca9532: Check i2c_smbus_read_byte_data() return value Coverity report INTEGER_OVERFLOW (tainted_data_return -> cast_underflow -> overflow) in pca9532_getled(). pca9532_getled() stored the return value of i2c_smbus_read_byte_data() into a char and used it directly to compute the LED state without checking for an error. i2c_smbus_read_byte_data() returns a negative error code on failure. On an I2C read error the negative value was assigned to an unsigned type, triggering an integer underflow/overflow, and a meaningless LED state was returned to the caller. Read the value into an int, check for the error, and fall back to PCA9532_OFF while emitting a warning when the read fails. Fixes: 28c5fe99016d ("leds: pca9532: Extend pca9532 device tree support") Assisted-by: VeroCoder:vero-1 [cli] Signed-off-by: Haibo Chen Reviewed-by: Frank Li Link: https://patch.msgid.link/20260727-led-fix-v1-1-d635c5037109@nxp.com Signed-off-by: Lee Jones --- drivers/leds/leds-pca9532.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/drivers/leds/leds-pca9532.c b/drivers/leds/leds-pca9532.c index b2e081c8f139..1133fa348e24 100644 --- a/drivers/leds/leds-pca9532.c +++ b/drivers/leds/leds-pca9532.c @@ -298,12 +298,15 @@ static enum pca9532_state pca9532_getled(struct pca9532_led *led) struct i2c_client *client = led->client; struct pca9532_data *data = i2c_get_clientdata(client); u8 maxleds = data->chip_info->num_leds; - char reg; - enum pca9532_state ret; + int reg; + enum pca9532_state ret = PCA9532_OFF; mutex_lock(&data->update_lock); reg = i2c_smbus_read_byte_data(client, LED_REG(maxleds, led->id)); - ret = (reg & LED_MASK(led->id)) >> LED_SHIFT(led->id); + if (reg >= 0) + ret = (reg & LED_MASK(led->id)) >> LED_SHIFT(led->id); + else + dev_warn(&client->dev, "failed to read LED register: %d\n", reg); mutex_unlock(&data->update_lock); return ret; }