[PATCH] gpio: pca953x: Handle direction register read errors in IRQ paths

[PATCH] gpio: pca953x: Handle direction register read errors in IRQ paths

[Sahaj Chaudhari]

Three IRQ paths ignore the result of reading the direction registers
and then use the destination bitmap. pca953x_read_regs() does not populate
that bitmap when regmap_bulk_read() fails, leaving the callers to use
uninitialized stack data.

This can select incorrect GPIOs for direction changes during IRQ bus
synchronization, corrupt the saved input state during IRQ setup, or
produce incorrect pending interrupt decisions.

Check the read result at all three sites. Release irq_lock without
changing GPIO directions on failure, leave the IRQ history untouched
when pending detection fails, and propagate the error from IRQ setup.
The read helper already logs the error.

Fixes: 0f25fda840a9 ("gpio: pca953x: Zap ad-hoc reg_direction cache")
Cc: stable@vger.kernel.org
Signed-off-by: Sahaj Chaudhari <sahaj123.sc@gmail.com>
---
Testing:
- Built an ARM64 kernel with CONFIG_GPIO_PCA953X_IRQ=y,
  CONFIG_PM_SLEEP=y and CONFIG_SUSPEND=y, containing this fix alone.
- Booted it on AM642 and confirmed both expected expanders bound to
  pca953x, with an untainted kernel.
- Ran the isolated exact-function harness on an AM642 CPU: 22 checks,
  three failures before and none after. The same isolated checks passed
  host ASan and UBSan. This harness simulates kernel and hardware APIs.

The hardware test covers boot and probe, not the IRQ error paths.
Neither expander has IRQs configured in this board's device tree, so
direction-register read failures were exercised only in the harness.

 drivers/gpio/gpio-pca953x.c | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c
index aac9ea7520b6..b6f0849d3bdf 100644
--- a/drivers/gpio/gpio-pca953x.c
+++ b/drivers/gpio/gpio-pca953x.c
@@ -862,6 +862,7 @@ static void pca953x_irq_bus_sync_unlock(struct irq_data *d)
 	DECLARE_BITMAP(irq_mask, MAX_LINE);
 	DECLARE_BITMAP(reg_direction, MAX_LINE);
 	int level;
+	int ret;
 
 	guard(mutex)(&chip->i2c_lock);
 
@@ -880,7 +881,9 @@ static void pca953x_irq_bus_sync_unlock(struct irq_data *d)
 	}
 
 	/* Switch direction to input if needed */
-	pca953x_read_regs(chip, chip->regs->direction, reg_direction);
+	ret = pca953x_read_regs(chip, chip->regs->direction, reg_direction);
+	if (ret)
+		goto out;
 
 	bitmap_or(irq_mask, chip->irq_trig_fall, chip->irq_trig_raise, gc->ngpio);
 	bitmap_or(irq_mask, irq_mask, chip->irq_trig_level_high, gc->ngpio);
@@ -890,6 +893,7 @@ static void pca953x_irq_bus_sync_unlock(struct irq_data *d)
 	for_each_andnot_bit(level, irq_mask, reg_direction, gc->ngpio)
 		pca953x_gpio_direction_input_unlocked(&chip->gpio_chip, level);
 
+out:
 	mutex_unlock(&chip->irq_lock);
 }
 
@@ -984,7 +988,9 @@ static bool pca953x_irq_pending(struct pca953x_chip *chip, unsigned long *pendin
 	}
 
 	/* Remove output pins from the equation */
-	pca953x_read_regs(chip, chip->regs->direction, reg_direction);
+	ret = pca953x_read_regs(chip, chip->regs->direction, reg_direction);
+	if (ret)
+		return false;
 
 	bitmap_copy(old_stat, chip->irq_stat, gc->ngpio);
 
@@ -1084,7 +1090,9 @@ static int pca953x_irq_setup(struct pca953x_chip *chip, int irq_base)
 	 * interrupt.  We have to rely on the previous read for
 	 * this purpose.
 	 */
-	pca953x_read_regs(chip, chip->regs->direction, reg_direction);
+	ret = pca953x_read_regs(chip, chip->regs->direction, reg_direction);
+	if (ret)
+		return ret;
 	bitmap_and(chip->irq_stat, irq_stat, reg_direction, gc->ngpio);
 	mutex_init(&chip->irq_lock);
 

base-commit: ac46dac1613a7c971e28e16d3a7a6ad4b1ae6c5a
-- 
2.43.0

Re: [PATCH] gpio: pca953x: Handle direction register read errors in IRQ paths

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] gpio: pca953x: mixing guard() and goto in pca953x_irq_bus_sync_unlock()
--

commit f8c41495cf791bc6655e128fd9192a150f30aa3c
Author: Sahaj Chaudhari <sahaj123.sc@gmail.com>

gpio: pca953x: Handle direction register read errors in IRQ paths

This commit adds error checking for direction register reads in
pca953x_irq_bus_sync_unlock(), pca953x_irq_pending(), and
pca953x_irq_setup() to avoid using uninitialized stack bitmaps when
pca953x_read_regs() fails.

> diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c
> index aac9ea7520b60..b6f0849d3bdf9 100644
> --- a/drivers/gpio/gpio-pca953x.c
> +++ b/drivers/gpio/gpio-pca953x.c
> @@ -862,6 +862,7 @@ static void pca953x_irq_bus_sync_unlock(struct irq_data *d)
>  	DECLARE_BITMAP(irq_mask, MAX_LINE);
>  	DECLARE_BITMAP(reg_direction, MAX_LINE);
>  	int level;
> +	int ret;
>  
>  	guard(mutex)(&chip->i2c_lock);
>  
> @@ -880,7 +881,9 @@ static void pca953x_irq_bus_sync_unlock(struct irq_data *d)
>  	}
>  
>  	/* Switch direction to input if needed */
> -	pca953x_read_regs(chip, chip->regs->direction, reg_direction);
> +	ret = pca953x_read_regs(chip, chip->regs->direction, reg_direction);
> +	if (ret)
> +		goto out;
>  
>  	bitmap_or(irq_mask, chip->irq_trig_fall, chip->irq_trig_raise, gc->ngpio);
>  	bitmap_or(irq_mask, irq_mask, chip->irq_trig_level_high, gc->ngpio);
> @@ -890,6 +893,7 @@ static void pca953x_irq_bus_sync_unlock(struct irq_data *d)
>  	for_each_andnot_bit(level, irq_mask, reg_direction, gc->ngpio)
>  		pca953x_gpio_direction_input_unlocked(&chip->gpio_chip, level);
>  
> +out:
>  	mutex_unlock(&chip->irq_lock);
>  }

[Severity: Low]
In drivers/gpio/gpio-pca953x.c, pca953x_irq_bus_sync_unlock() uses
guard(mutex)(&chip->i2c_lock) at function scope. When pca953x_read_regs()
returns an error, this change jumps to the new out label to unlock
chip->irq_lock.

Per include/linux/cleanup.h:

    * Lastly, given that the benefit of cleanup helpers is removal of
    * "goto", and that the "goto" statement can jump between scopes, the
    * expectation is that usage of "goto" and cleanup helpers is never
    * mixed in the same function. I.e. for a given routine, convert all
    * resources that need a "goto" cleanup to scope-based cleanup, or
    * convert none of them.

Could pca953x_irq_bus_sync_unlock() avoid mixing guard() and goto by wrapping
the direction update in an if (!ret) block (or using scoped_guard(mutex,
&chip->i2c_lock) around the I2C accesses before unlocking chip->irq_lock)?

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261018165003.3372368-1-sahaj123.sc@gmail.com?part=1

Re: [PATCH] gpio: pca953x: Handle direction register read errors in IRQ paths

[Bartosz Golaszewski]

On Sun, 18 Oct 2026 18:50:03 +0200, Sahaj Chaudhari
<sahaj123.sc@gmail.com> said:
> Three IRQ paths ignore the result of reading the direction registers
> and then use the destination bitmap. pca953x_read_regs() does not populate
> that bitmap when regmap_bulk_read() fails, leaving the callers to use
> uninitialized stack data.
>
> This can select incorrect GPIOs for direction changes during IRQ bus
> synchronization, corrupt the saved input state during IRQ setup, or
> produce incorrect pending interrupt decisions.
>
> Check the read result at all three sites. Release irq_lock without
> changing GPIO directions on failure, leave the IRQ history untouched
> when pending detection fails, and propagate the error from IRQ setup.
> The read helper already logs the error.
>
> Fixes: 0f25fda840a9 ("gpio: pca953x: Zap ad-hoc reg_direction cache")
> Cc: stable@vger.kernel.org
> Signed-off-by: Sahaj Chaudhari <sahaj123.sc@gmail.com>
> ---

Sashiko is technically right but we're staying in the same scope with the jump
and we can't guard the irq lock in this specific case so I'll ignore it.

Bart

Re: [PATCH] gpio: pca953x: Handle direction register read errors in IRQ paths

[Bartosz Golaszewski]

On Sun, 18 Oct 2026 22:20:03 +0530, Sahaj Chaudhari wrote:
> Three IRQ paths ignore the result of reading the direction registers
> and then use the destination bitmap. pca953x_read_regs() does not populate
> that bitmap when regmap_bulk_read() fails, leaving the callers to use
> uninitialized stack data.
> 
> This can select incorrect GPIOs for direction changes during IRQ bus
> synchronization, corrupt the saved input state during IRQ setup, or
> produce incorrect pending interrupt decisions.
> 
> [...]

Applied, thanks!

[1/1] gpio: pca953x: Handle direction register read errors in IRQ paths
      https://git.kernel.org/brgl/c/a0fe269293509acdd93b9cfb3f46636f7b91b33a

Best regards,
-- 
Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>