* Re: [PATCH] Input: tca8418_keypad - fix potential infinite loop and OOB, access on I2C error
2026-07-23 3:41 [PATCH] Input: tca8418_keypad - fix potential infinite loop and OOB, access on I2C error Liang Zhan
@ 2026-07-25 0:47 ` Dmitry Torokhov
2026-07-25 8:09 ` [PATCH v2] Input: tca8418_keypad - fix potential infinite loop and OOB access on invalid keycodes Liang Zhan
1 sibling, 0 replies; 3+ messages in thread
From: Dmitry Torokhov @ 2026-07-25 0:47 UTC (permalink / raw)
To: Liang Zhan; +Cc: linux-input, linux-kernel
Hi Liang,
On Thu, Jul 23, 2026 at 11:41:43AM +0800, Liang Zhan wrote:
> From 187224ee38e19fd3f74bfc08d1908c97398fef82 Mon Sep 17 00:00:00 2001
> From: Zhian Liang <liangzhan5dev@gmail.com>
> Date: Thu, 23 Jul 2026 00:08:15 +0800
> Subject: [PATCH] Input: tca8418_keypad - fix potential infinite loop and OOB
> access on I2C error
> MIME-Version: 1.0
> Content-Type: text/plain; charset=UTF-8
> Content-Transfer-Encoding: 8bit
> If the I2C bus returns 0xFF (e.g., due to a stuck bus or device fault),
> the original code would treat it as a valid key event, leading to two
> critical issues:
> 1. The loop in tca8418_read_keypad() would never terminate because the
> condition "reg <= 0" is false for 0xFF (255). This stalls the threaded
> IRQ handler indefinitely.
Not everything that Sashiko generates needs to be taken literally. If
transfer glitches I expect I2C core signal this properly.
> 2. The extracted hardware keycode (127) is used to compute row/col
> indices that exceed the valid range (rows*cols ≤ 80), causing an
> out-of-bounds read on "keymap[code]" when reporting the key.
> Fix both by:
> - Recognizing 0xFF as an empty FIFO condition (along with 0x00).
> - Validating the keycode before calculating row/col, skipping invalid
> codes and preventing array overrun.
> Cc: stable@vger.kernel.org
> Signed-off-by: Zhian Liang <liangzhan5dev@gmail.com>
> ---
> drivers/input/keyboard/tca8418_keypad.c | 11 +++++++++--
> 1 file changed, 9 insertions(+), 2 deletions(-)
> diff --git a/drivers/input/keyboard/tca8418_keypad.c
> b/drivers/input/keyboard/tca8418_keypad.c
> index b124e576feca..cec6a589192d 100644
> --- a/drivers/input/keyboard/tca8418_keypad.c
> +++ b/drivers/input/keyboard/tca8418_keypad.c
> @@ -171,13 +171,20 @@ static void tca8418_read_keypad(struct tca8418_keypad
> *keypad_data)
> break;
> }
> - /* Assume that key code 0 signifies empty FIFO */
> - if (reg <= 0)
> + /* 0x00 = empty FIFO, 0xFF = likely bus fault */
> + if (reg == 0 || reg == 0xFF)
> break;
> state = reg & KEY_EVENT_VALUE;
> code = reg & KEY_EVENT_CODE;
Jet's move the check for empty FIFO here:
if (!code)
return;
> + /* validate keycode: must be non-zero and within hardware limits */
> + if (code == 0 || code > TCA8418_MAX_ROWS * TCA8418_MAX_COLS){
This check is not sufficient if keypad is configured to use just part of
potential matrix. We need to make sure that row and col is within the
rows and cold limits we set up for the keypad.
Thanks.
--
Dmitry
^ permalink raw reply [flat|nested] 3+ messages in thread* [PATCH v2] Input: tca8418_keypad - fix potential infinite loop and OOB access on invalid keycodes
2026-07-23 3:41 [PATCH] Input: tca8418_keypad - fix potential infinite loop and OOB, access on I2C error Liang Zhan
2026-07-25 0:47 ` Dmitry Torokhov
@ 2026-07-25 8:09 ` Liang Zhan
1 sibling, 0 replies; 3+ messages in thread
From: Liang Zhan @ 2026-07-25 8:09 UTC (permalink / raw)
To: dmitry.torokhov; +Cc: linux-input, linux-kernel, stable
The current code checks the raw register value against zero to detect an
empty FIFO. However, the TCA8418 datasheet defines key code 0 as the
empty-FIFO condition. If the hardware returns garbage data, the loop may
never terminate and the extracted keycode can cause an out-of-bounds
access on keymap[].
Move the empty-FIFO check to operate on the extracted key code so that
the loop terminates correctly. Additionally, validate row/column indices
against the configured matrix dimensions before indexing into the
keymap array, skipping invalid events.
Cc: stable@vger.kernel.org
Signed-off-by: Zhian Liang <liangzhan5dev@gmail.com>
---
changes in v2:
- Moved empty-FIFO check to operate on extracted key code instead of
raw register value.
- Added row/col validation against configured matrix dimensions.
- Dropped explicit 0xFF check as requested.
---
drivers/input/keyboard/tca8418_keypad.c | 19 ++++++++++++++++---
1 file changed, 16 insertions(+), 3 deletions(-)
diff --git a/drivers/input/keyboard/tca8418_keypad.c
b/drivers/input/keyboard/tca8418_keypad.c
index b124e576feca..36d4a7c38bb1 100644
--- a/drivers/input/keyboard/tca8418_keypad.c
+++ b/drivers/input/keyboard/tca8418_keypad.c
@@ -114,6 +114,8 @@ struct tca8418_keypad {
struct input_dev *input;
unsigned int row_shift;
+ unsigned int rows;
+ unsigned int cols;
};
/*
@@ -171,19 +173,28 @@ static void tca8418_read_keypad(struct
tca8418_keypad *keypad_data)
break;
}
- /* Assume that key code 0 signifies empty FIFO */
- if (reg <= 0)
- break;
state = reg & KEY_EVENT_VALUE;
code = reg & KEY_EVENT_CODE;
+ /* Key code 0 signifies empty FIFO */
+ if (!code)
+ break;
+
row = code / TCA8418_MAX_COLS;
col = code % TCA8418_MAX_COLS;
row = (col) ? row : row - 1;
col = (col) ? col - 1 : TCA8418_MAX_COLS - 1;
+ /* Validate against configured matrix size */
+ if (row >= keypad_data->rows || col >= keypad_data->cols) {
+ dev_err(&keypad_data->client->dev,
+ "invalid key code %d (row %d, col %d)\n",
+ code, row, col);
+ continue;
+ }
+
code = MATRIX_SCAN_CODE(row, col, keypad_data->row_shift);
input_event(input, EV_MSC, MSC_SCAN, code);
input_report_key(input, keymap[code], state);
@@ -298,6 +309,8 @@ static int tca8418_keypad_probe(struct i2c_client
*client)
keypad_data->client = client;
keypad_data->row_shift = row_shift;
+ keypad_data->rows = rows;
+ keypad_data->cols = cols;
/* Read key lock register, if this fails assume device not present */
error = tca8418_read_byte(keypad_data, REG_KEY_LCK_EC, ®);
--
2.34.1
^ permalink raw reply related [flat|nested] 3+ messages in thread