From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pj1-f43.google.com (mail-pj1-f43.google.com [209.85.216.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A822331C56D for ; Tue, 14 Jul 2026 04:10:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.43 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784002215; cv=none; b=mnJAnafLTEqNjNdQOCJodr8g6c2VqwlvkCNTl57vBOoJqNIwVPkyTnN6rJ+6n9xOxJi7dra6W6auYFA2Is+HBOleO9yxrmTY/PbOz5EJfPIDkE3P47kYB2khbVuJScRm9daOVHpGpJbBttVKdLi7MYXG+Sn9wGL3anTKllHbXwE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784002215; c=relaxed/simple; bh=1I5d/x8TmXAo2DYkcbkEXw/YcDdbG7wswR43SGbbKH0=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=QG3+6KDyb1GJPwa2GTM+U+db4/INO6wBU1qz1WCeGNCTzB2LeMwWaY3bPflJl+wy5fnP0HSwG+n/1pctaoOwsZJrYoC2EpXDH3+To8BtI4G/77LSQ5vVemsKQ0HERLK3yQl75Oikm5zzAgcQoiFxVs/90Z4jHb0ex6BHrKL88MM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=NL17uLF/; arc=none smtp.client-ip=209.85.216.43 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="NL17uLF/" Received: by mail-pj1-f43.google.com with SMTP id 98e67ed59e1d1-38e041ea211so1295680a91.0 for ; Mon, 13 Jul 2026 21:10:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784002212; x=1784607012; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=xWxdWCH6np2tScIBqHNcQfCeX/vCBNcQJo3+LIYcM38=; b=NL17uLF/yXHTmrUQ5hi7aO5H3SoOgKTigN+dww0S3qJlV7th9SPIgqo5hZWhIXOGlP evk3oE37DxEFqwSg+sGjscZl18xAvr6FxVUcQ07B/BlXrOo28yweX5DgJ/20xFM7owR4 3YQbzXX7OnE08krkaHAc5bAjRibQ13dG2QVbbMR5KQ/0vv/AWZ9e/rtBNmkhOkRWjoTf qLutxyabnrjS/5vhbNWdyCBqgJP7BoNr462WfYsvr70N2MPimnaM6ICb2y8Fwfwibd8H 206XOwANNouV7bx6Irk3B72urDkr4U8b3ss1GJUJ32MZrbdXvz9n7ZoVq0rQ9d8dVMpz tqiQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784002212; x=1784607012; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=xWxdWCH6np2tScIBqHNcQfCeX/vCBNcQJo3+LIYcM38=; b=ZKDPFago1N6dJ0u2TK2g7cz+S3XwdX17oIopqS5Q3Z13iV7ISEyNZF1ZmSJDqfhDHM DABoQ7RrqSRRZ5tlMjsJW3evTLjRqRBYOYMK0dIdAATvNNeVCoQy4//UmPLvGQRNqq+w dIFF2eyBk8EWn01KKm31EdX5SfscXNGvYJwy6rpUXdJel60rJS27gakPNaadV84XYx9C my28vKXmvtnk9WWdchoRWaRw+1k86v9njs3oeSdvJZmQbSWD/B+FzfC8dUHZ37SkB6B/ hMn9jvJe2aoPLavX4C/T9hpOfEJOmGcNT4KvaVzDnAqXhVjIrS6R+0w8IU5EUDd40tx6 OKYw== X-Forwarded-Encrypted: i=1; AHgh+Rqmp6Cp6sq2egIFtVDhujVd7wjwKppqjp/Mwnnvlj1F8/uj6lSzWTTfJSAOkNIPostCz56yQO8nvw26y/A=@vger.kernel.org X-Gm-Message-State: AOJu0YzPpGgnKFWreUAaAPUmqS8PLMpbraMjucVR7qdi+LrbRS6bqyc1 /jc/lzbcxBqvbLOFQ82GX0LReGZvj6J87JXsZAGPBtoBRfbIE71RdMlO X-Gm-Gg: AfdE7clZUR7XG97OhM06f+Raghi5zxXPnJXHgwbmFdAI4SkMysVM598ViOLs4N+XvxP 1kNGr5mm6a7bBe02c6HiYiqkIlxzouDIYP8rSQR4/nut3jJ0XJYY2rOO0MKd1q2lMYC+CitDamy DlcMwgcajjDaTdCLuq4/FPstPwUcBYQJW4Y4Q3CjZGmTpwei8BS9aqpY7JbPWs+3Lon8R0HKhiz I7W/a2gUPZYjvMFweS7LDLMBneQ9iykVfN+m29QYsBuA8dSNqn8130c0M1cL++JxULqMY/J2kkO AKIOiH2szGZco5GVHtXjdHJIkJUssYLuHIYXKfERh8sg/twOjtH2/ZzVX6xVjcckwkqDMzOC+6W OyIJZFIZYjdsC3NEyWKQqDB8SxjGhIGzesg6Bq+9+IhXvIukQzmskSne46hxU+sStz84aq84Vza E6ieW/L+xdU/6l X-Received: by 2002:a17:90b:3c8a:b0:38e:baf:6087 with SMTP id 98e67ed59e1d1-38e1af3fbf1mr879125a91.35.1784002212376; Mon, 13 Jul 2026 21:10:12 -0700 (PDT) Received: from kdev.. ([108.180.130.139]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-38e1745a596sm771800a91.15.2026.07.13.21.10.11 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 13 Jul 2026 21:10:11 -0700 (PDT) From: Babanpreet Singh To: Krzysztof Kozlowski Cc: Greg Kroah-Hartman , =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= , linux-kernel@vger.kernel.org, Babanpreet Singh Subject: [PATCH] w1: ds2482: Fix signedness bug in ds2482_w1_triplet() Date: Tue, 14 Jul 2026 04:10:10 +0000 Message-ID: <20260714041011.7-1-bbnpreetsingh@gmail.com> X-Mailer: git-send-email 2.47.3 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit ds2482_wait_1wire_idle() returns the status register value (0..255) on success, or a negative value on I2C failure: -1 when selecting the status register fails, or a negative errno from i2c_smbus_read_byte(). ds2482_w1_triplet() feeds that result into "return (status >> 5);" without checking for errors, and the function returns u8. For a negative status the arithmetic shift keeps the sign and the u8 truncation fabricates a triplet result whose meaning depends on the errno value: -1 and -EIO happen to become 0xff, whose set low bits make w1_search() abort, but -ETIMEDOUT (-110 >> 5 = -4) becomes 0xfc - "devices responded on both branches, wrote 1" - and -EOPNOTSUPP (-95 >> 5 = -3) becomes 0xfd - "only the zero branch responded". w1_search() then continues the ROM search with a fabricated direction bit instead of aborting, and the corrupted id is either rejected by the ROM CRC (existing device missed) or registers a phantom slave. The function already defines an in-band error value: status is initialized to (3 << 5), which decodes to 3 (both branch bits set, "no device responded") and makes w1_search() terminate the search when sending the triplet command fails. Decode a negative status to the same value. Found by smatch: drivers/w1/masters/ds2482.c:314 ds2482_w1_triplet() warn: signedness bug returning '(-67108864)' Fixes: baf12ae29ab4 ("[PATCH] W1: Add the DS2482 I2C-to-w1 bridge driver.") Assisted-by: Claude:claude-sonnet-5 Signed-off-by: Babanpreet Singh --- Note: ds2482_w1_touch_bit() has a related imperfection (it masks a possibly negative status with DS2482_REG_STS_SBR), but its u8 0/1 ops contract has no in-band error value at all, so a correct fix there needs a w1 ops-interface change - deliberately not part of this minimal fix. Happy to look into that as a follow-up if there is interest. drivers/w1/masters/ds2482.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/w1/masters/ds2482.c b/drivers/w1/masters/ds2482.c index 0069e6f854d7..7622c8782844 100644 --- a/drivers/w1/masters/ds2482.c +++ b/drivers/w1/masters/ds2482.c @@ -310,6 +310,10 @@ static u8 ds2482_w1_triplet(void *data, u8 dbit) mutex_unlock(&pdev->access_lock); + /* On bus error, decode to 3 (no device responded) to abort the search */ + if (status < 0) + status = 3 << 5; + /* Decode the status */ return (status >> 5); } base-commit: 3b029c035b34bbc693405ddf759f0e9b920c27f1 -- 2.43.0