* [PATCH] hw/gpio/pca9552: fix off-by-one in QOM led index validation
@ 2026-06-29 7:41 yujun
2026-06-29 9:39 ` Cédric Le Goater
` (3 more replies)
0 siblings, 4 replies; 5+ messages in thread
From: yujun @ 2026-06-29 7:41 UTC (permalink / raw)
To: Glenn Miles; +Cc: qemu-ppc, qemu-arm, qemu-devel
pca955x_get_led() and pca955x_set_led() accept led indices equal to
pin_count, but valid indices are 0..pin_count-1. For a 16-pin device,
led16 passes the current check and then accesses an LS register past
max_reg.
Use the same >= pin_count bounds check as pca9554_set_pin() and the
gpio input handler assert in this file.
Fixes: a90d8f84674 ("misc/pca9552: Add qom set and get")
Signed-off-by: yujun <yujun@kylinos.cn>
---
hw/gpio/pca9552.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/hw/gpio/pca9552.c b/hw/gpio/pca9552.c
index 472d8ad957..b13ac9fd9c 100644
--- a/hw/gpio/pca9552.c
+++ b/hw/gpio/pca9552.c
@@ -311,8 +311,8 @@ static void pca955x_get_led(Object *obj, Visitor *v, const char *name,
error_setg(errp, "%s: error reading %s", __func__, name);
return;
}
- if (led < 0 || led > k->pin_count) {
- error_setg(errp, "%s invalid led %s", __func__, name);
+ if (led < 0 || led >= k->pin_count) {
+ error_setg(errp, "%s: invalid led %s", __func__, name);
return;
}
/*
@@ -352,8 +352,8 @@ static void pca955x_set_led(Object *obj, Visitor *v, const char *name,
error_setg(errp, "%s: error reading %s", __func__, name);
return;
}
- if (led < 0 || led > k->pin_count) {
- error_setg(errp, "%s invalid led %s", __func__, name);
+ if (led < 0 || led >= k->pin_count) {
+ error_setg(errp, "%s: invalid led %s", __func__, name);
return;
}
--
2.25.1
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH] hw/gpio/pca9552: fix off-by-one in QOM led index validation
2026-06-29 7:41 [PATCH] hw/gpio/pca9552: fix off-by-one in QOM led index validation yujun
@ 2026-06-29 9:39 ` Cédric Le Goater
2026-06-29 9:45 ` Peter Maydell
` (2 subsequent siblings)
3 siblings, 0 replies; 5+ messages in thread
From: Cédric Le Goater @ 2026-06-29 9:39 UTC (permalink / raw)
To: yujun, Glenn Miles; +Cc: qemu-ppc, qemu-arm, qemu-devel
Glenn,
Cc: me if you ack this change. I can take it through the aspeed queue.
Thanks,
C.
On 6/29/26 09:41, yujun wrote:
> pca955x_get_led() and pca955x_set_led() accept led indices equal to
> pin_count, but valid indices are 0..pin_count-1. For a 16-pin device,
> led16 passes the current check and then accesses an LS register past
> max_reg.
>
> Use the same >= pin_count bounds check as pca9554_set_pin() and the
> gpio input handler assert in this file.
>
> Fixes: a90d8f84674 ("misc/pca9552: Add qom set and get")
> Signed-off-by: yujun <yujun@kylinos.cn>
> ---
> hw/gpio/pca9552.c | 8 ++++----
> 1 file changed, 4 insertions(+), 4 deletions(-)
>
> diff --git a/hw/gpio/pca9552.c b/hw/gpio/pca9552.c
> index 472d8ad957..b13ac9fd9c 100644
> --- a/hw/gpio/pca9552.c
> +++ b/hw/gpio/pca9552.c
> @@ -311,8 +311,8 @@ static void pca955x_get_led(Object *obj, Visitor *v, const char *name,
> error_setg(errp, "%s: error reading %s", __func__, name);
> return;
> }
> - if (led < 0 || led > k->pin_count) {
> - error_setg(errp, "%s invalid led %s", __func__, name);
> + if (led < 0 || led >= k->pin_count) {
> + error_setg(errp, "%s: invalid led %s", __func__, name);
> return;
> }
> /*
> @@ -352,8 +352,8 @@ static void pca955x_set_led(Object *obj, Visitor *v, const char *name,
> error_setg(errp, "%s: error reading %s", __func__, name);
> return;
> }
> - if (led < 0 || led > k->pin_count) {
> - error_setg(errp, "%s invalid led %s", __func__, name);
> + if (led < 0 || led >= k->pin_count) {
> + error_setg(errp, "%s: invalid led %s", __func__, name);
> return;
> }
>
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] hw/gpio/pca9552: fix off-by-one in QOM led index validation
2026-06-29 7:41 [PATCH] hw/gpio/pca9552: fix off-by-one in QOM led index validation yujun
2026-06-29 9:39 ` Cédric Le Goater
@ 2026-06-29 9:45 ` Peter Maydell
2026-06-29 14:34 ` Miles Glenn
2026-06-29 14:56 ` Philippe Mathieu-Daudé
3 siblings, 0 replies; 5+ messages in thread
From: Peter Maydell @ 2026-06-29 9:45 UTC (permalink / raw)
To: yujun; +Cc: Glenn Miles, qemu-ppc, qemu-arm, qemu-devel,
Cédric Le Goater
On Mon, 29 Jun 2026 at 08:42, yujun <yujun@kylinos.cn> wrote:
>
> pca955x_get_led() and pca955x_set_led() accept led indices equal to
> pin_count, but valid indices are 0..pin_count-1. For a 16-pin device,
> led16 passes the current check and then accesses an LS register past
> max_reg.
>
> Use the same >= pin_count bounds check as pca9554_set_pin() and the
> gpio input handler assert in this file.
>
> Fixes: a90d8f84674 ("misc/pca9552: Add qom set and get")
> Signed-off-by: yujun <yujun@kylinos.cn>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
thanks
-- PMM
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] hw/gpio/pca9552: fix off-by-one in QOM led index validation
2026-06-29 7:41 [PATCH] hw/gpio/pca9552: fix off-by-one in QOM led index validation yujun
2026-06-29 9:39 ` Cédric Le Goater
2026-06-29 9:45 ` Peter Maydell
@ 2026-06-29 14:34 ` Miles Glenn
2026-06-29 14:56 ` Philippe Mathieu-Daudé
3 siblings, 0 replies; 5+ messages in thread
From: Miles Glenn @ 2026-06-29 14:34 UTC (permalink / raw)
To: yujun; +Cc: qemu-ppc, qemu-arm, qemu-devel, Cédric Le Goater
Reviewed-by: Glenn Miles <milesg@linux.ibm.com>
Thanks,
Glenn
On Mon, 2026-06-29 at 15:41 +0800, yujun wrote:
> pca955x_get_led() and pca955x_set_led() accept led indices equal to
> pin_count, but valid indices are 0..pin_count-1. For a 16-pin device,
> led16 passes the current check and then accesses an LS register past
> max_reg.
>
> Use the same >= pin_count bounds check as pca9554_set_pin() and the
> gpio input handler assert in this file.
>
> Fixes: a90d8f84674 ("misc/pca9552: Add qom set and get")
> Signed-off-by: yujun <yujun@kylinos.cn>
> ---
> hw/gpio/pca9552.c | 8 ++++----
> 1 file changed, 4 insertions(+), 4 deletions(-)
>
> diff --git a/hw/gpio/pca9552.c b/hw/gpio/pca9552.c
> index 472d8ad957..b13ac9fd9c 100644
> --- a/hw/gpio/pca9552.c
> +++ b/hw/gpio/pca9552.c
> @@ -311,8 +311,8 @@ static void pca955x_get_led(Object *obj, Visitor *v, const char *name,
> error_setg(errp, "%s: error reading %s", __func__, name);
> return;
> }
> - if (led < 0 || led > k->pin_count) {
> - error_setg(errp, "%s invalid led %s", __func__, name);
> + if (led < 0 || led >= k->pin_count) {
> + error_setg(errp, "%s: invalid led %s", __func__, name);
> return;
> }
> /*
> @@ -352,8 +352,8 @@ static void pca955x_set_led(Object *obj, Visitor *v, const char *name,
> error_setg(errp, "%s: error reading %s", __func__, name);
> return;
> }
> - if (led < 0 || led > k->pin_count) {
> - error_setg(errp, "%s invalid led %s", __func__, name);
> + if (led < 0 || led >= k->pin_count) {
> + error_setg(errp, "%s: invalid led %s", __func__, name);
> return;
> }
>
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] hw/gpio/pca9552: fix off-by-one in QOM led index validation
2026-06-29 7:41 [PATCH] hw/gpio/pca9552: fix off-by-one in QOM led index validation yujun
` (2 preceding siblings ...)
2026-06-29 14:34 ` Miles Glenn
@ 2026-06-29 14:56 ` Philippe Mathieu-Daudé
3 siblings, 0 replies; 5+ messages in thread
From: Philippe Mathieu-Daudé @ 2026-06-29 14:56 UTC (permalink / raw)
To: yujun, Glenn Miles; +Cc: qemu-ppc, qemu-arm, qemu-devel
On 29/6/26 09:41, yujun wrote:
> pca955x_get_led() and pca955x_set_led() accept led indices equal to
> pin_count, but valid indices are 0..pin_count-1. For a 16-pin device,
> led16 passes the current check and then accesses an LS register past
> max_reg.
>
> Use the same >= pin_count bounds check as pca9554_set_pin() and the
> gpio input handler assert in this file.
>
> Fixes: a90d8f84674 ("misc/pca9552: Add qom set and get")
> Signed-off-by: yujun <yujun@kylinos.cn>
> ---
> hw/gpio/pca9552.c | 8 ++++----
> 1 file changed, 4 insertions(+), 4 deletions(-)
Queued via hw-misc, thanks!
Phil.
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2026-06-29 14:57 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-06-29 7:41 [PATCH] hw/gpio/pca9552: fix off-by-one in QOM led index validation yujun
2026-06-29 9:39 ` Cédric Le Goater
2026-06-29 9:45 ` Peter Maydell
2026-06-29 14:34 ` Miles Glenn
2026-06-29 14:56 ` Philippe Mathieu-Daudé
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.