Re: [PATCH v2 1/5] mfd: cgbc: Fix use of negative error code as valid session handle

[Lee Jones <lee@kernel.org>]

On Tue, 11 Aug 2026, Thomas Richard (congatec GmbH) wrote:

> The cgbc_session_command() return value was directly cast to u8 and used
> as session handle without error checking. Casting a negative error to u8
> produces a valid-looking session handle. So check if return value is
> positive before to cast and use it.
> 
> Cc: stable@vger.kernel.org
> Reported-by: Sashiko <sashiko-bot@kernel.org>
> Closes: https://sashiko.dev/#/patchset/20260713-cgbc-core-fix-cgbc-remove-v1-1-79274ad62b3a%40bootlin.com?part=1
> Fixes: 6f1067cfbee7 ("mfd: Add Congatec Board Controller driver")
> Signed-off-by: Thomas Richard (congatec GmbH) <thomas.richard@bootlin.com>
> ---
>  drivers/mfd/cgbc-core.c | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/mfd/cgbc-core.c b/drivers/mfd/cgbc-core.c
> index 2becaf797646..4a409234e66c 100644
> --- a/drivers/mfd/cgbc-core.c
> +++ b/drivers/mfd/cgbc-core.c
> @@ -103,7 +103,11 @@ static int cgbc_session_request(struct cgbc_device_data *cgbc)
>  	if (ret)
>  		return dev_err_probe(cgbc->dev, ret, "device not found or not ready\n");
>  
> -	cgbc->session = cgbc_session_command(cgbc, CGBC_SESSION_CMD_REQUEST);
> +	ret = cgbc_session_command(cgbc, CGBC_SESSION_CMD_REQUEST);
> +	if (ret < 0)
> +		return dev_err_probe(cgbc->dev, ret, "session handle request timed out\n");

Can we make this a bit more user friendly?

"Failed to start XYZ session"?

> +
> +	cgbc->session = ret;
>  
>  	/* The Board Controller sent us a wrong session handle, we cannot communicate with it */
>  	if (cgbc->session < CGBC_SESSION_VALID_MIN || cgbc->session > CGBC_SESSION_VALID_MAX)
> 
> -- 
> 2.53.0
> 

-- 
Lee Jones