[PATCH] Input: tca8418_keypad - fix potential infinite loop and OOB, access on I2C error

[PATCH] Input: tca8418_keypad - fix potential infinite loop and OOB, access on I2C error

[Liang Zhan]

 From 187224ee38e19fd3f74bfc08d1908c97398fef82 Mon Sep 17 00:00:00 2001
From: Zhian Liang <liangzhan5dev@gmail.com>
Date: Thu, 23 Jul 2026 00:08:15 +0800
Subject: [PATCH] Input: tca8418_keypad - fix potential infinite loop and OOB
  access on I2C error
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
If the I2C bus returns 0xFF (e.g., due to a stuck bus or device fault),
the original code would treat it as a valid key event, leading to two
critical issues:
1. The loop in tca8418_read_keypad() would never terminate because the
    condition "reg <= 0" is false for 0xFF (255). This stalls the threaded
    IRQ handler indefinitely.
2. The extracted hardware keycode (127) is used to compute row/col
    indices that exceed the valid range (rows*cols ≤ 80), causing an
    out-of-bounds read on "keymap[code]" when reporting the key.
Fix both by:
- Recognizing 0xFF as an empty FIFO condition (along with 0x00).
- Validating the keycode before calculating row/col, skipping invalid
   codes and preventing array overrun.
Cc: stable@vger.kernel.org
Signed-off-by: Zhian Liang <liangzhan5dev@gmail.com>
---
  drivers/input/keyboard/tca8418_keypad.c | 11 +++++++++--
  1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/drivers/input/keyboard/tca8418_keypad.c 
b/drivers/input/keyboard/tca8418_keypad.c
index b124e576feca..cec6a589192d 100644
--- a/drivers/input/keyboard/tca8418_keypad.c
+++ b/drivers/input/keyboard/tca8418_keypad.c
@@ -171,13 +171,20 @@ static void tca8418_read_keypad(struct 
tca8418_keypad *keypad_data)
             break;
         }
-       /* Assume that key code 0 signifies empty FIFO */
-       if (reg <= 0)
+       /* 0x00 =  empty FIFO, 0xFF = likely bus fault */
+       if (reg == 0 || reg == 0xFF)
             break;
         state = reg & KEY_EVENT_VALUE;
         code  = reg & KEY_EVENT_CODE;
+       /* validate keycode: must be non-zero and within hardware limits */
+       if (code == 0 || code > TCA8418_MAX_ROWS * TCA8418_MAX_COLS){
+           dev_err(&keypad_data->client->dev,
+               "invalid key code: %d\n", code);
+           continue;
+       }
+
         row = code / TCA8418_MAX_COLS;
         col = code % TCA8418_MAX_COLS;
-- 
2.34.1

Re: [PATCH] Input: tca8418_keypad - fix potential infinite loop and OOB, access on I2C error

[Dmitry Torokhov]

Hi Liang,

On Thu, Jul 23, 2026 at 11:41:43AM +0800, Liang Zhan wrote:
> From 187224ee38e19fd3f74bfc08d1908c97398fef82 Mon Sep 17 00:00:00 2001
> From: Zhian Liang <liangzhan5dev@gmail.com>
> Date: Thu, 23 Jul 2026 00:08:15 +0800
> Subject: [PATCH] Input: tca8418_keypad - fix potential infinite loop and OOB
>  access on I2C error
> MIME-Version: 1.0
> Content-Type: text/plain; charset=UTF-8
> Content-Transfer-Encoding: 8bit
> If the I2C bus returns 0xFF (e.g., due to a stuck bus or device fault),
> the original code would treat it as a valid key event, leading to two
> critical issues:
> 1. The loop in tca8418_read_keypad() would never terminate because the
>    condition "reg <= 0" is false for 0xFF (255). This stalls the threaded
>    IRQ handler indefinitely.

Not everything that Sashiko generates needs to be taken literally. If
transfer glitches I expect I2C core signal this properly.

> 2. The extracted hardware keycode (127) is used to compute row/col
>    indices that exceed the valid range (rows*cols ≤ 80), causing an
>    out-of-bounds read on "keymap[code]" when reporting the key.
> Fix both by:
> - Recognizing 0xFF as an empty FIFO condition (along with 0x00).
> - Validating the keycode before calculating row/col, skipping invalid
>   codes and preventing array overrun.
> Cc: stable@vger.kernel.org
> Signed-off-by: Zhian Liang <liangzhan5dev@gmail.com>
> ---
>  drivers/input/keyboard/tca8418_keypad.c | 11 +++++++++--
>  1 file changed, 9 insertions(+), 2 deletions(-)
> diff --git a/drivers/input/keyboard/tca8418_keypad.c
> b/drivers/input/keyboard/tca8418_keypad.c
> index b124e576feca..cec6a589192d 100644
> --- a/drivers/input/keyboard/tca8418_keypad.c
> +++ b/drivers/input/keyboard/tca8418_keypad.c
> @@ -171,13 +171,20 @@ static void tca8418_read_keypad(struct tca8418_keypad
> *keypad_data)
>             break;
>         }
> -       /* Assume that key code 0 signifies empty FIFO */
> -       if (reg <= 0)
> +       /* 0x00 =  empty FIFO, 0xFF = likely bus fault */
> +       if (reg == 0 || reg == 0xFF)
>             break;
>         state = reg & KEY_EVENT_VALUE;
>         code  = reg & KEY_EVENT_CODE;

Jet's move the check for empty FIFO here:

	if (!code)
		return;

> +       /* validate keycode: must be non-zero and within hardware limits */
> +       if (code == 0 || code > TCA8418_MAX_ROWS * TCA8418_MAX_COLS){

This check is not sufficient if keypad is configured to use just part of
potential matrix. We need to make sure that row and col is within the
rows and cold limits we set up for the keypad.

Thanks.

-- 
Dmitry

[PATCH v2] Input: tca8418_keypad - fix potential infinite loop and OOB access on invalid keycodes

[Liang Zhan]

The current code checks the raw register value against zero to detect an 
empty FIFO. However, the TCA8418 datasheet defines key code 0 as the 
empty-FIFO condition. If the hardware returns garbage data, the loop may 
never terminate and the extracted keycode can cause an out-of-bounds 
access on keymap[].

Move the empty-FIFO check to operate on the extracted key code so that
the loop terminates correctly. Additionally, validate row/column indices
against the configured matrix dimensions before indexing into the
keymap array, skipping invalid events.

Cc: stable@vger.kernel.org
Signed-off-by: Zhian Liang <liangzhan5dev@gmail.com>
---
changes in v2:
- Moved empty-FIFO check to operate on extracted key code instead of
   raw register value.
- Added row/col validation against configured matrix dimensions.
- Dropped explicit 0xFF check as requested.
---
  drivers/input/keyboard/tca8418_keypad.c | 19 ++++++++++++++++---
  1 file changed, 16 insertions(+), 3 deletions(-)

diff --git a/drivers/input/keyboard/tca8418_keypad.c 
b/drivers/input/keyboard/tca8418_keypad.c
index b124e576feca..36d4a7c38bb1 100644
--- a/drivers/input/keyboard/tca8418_keypad.c
+++ b/drivers/input/keyboard/tca8418_keypad.c
@@ -114,6 +114,8 @@ struct tca8418_keypad {
  	struct input_dev *input;

  	unsigned int row_shift;
+	unsigned int rows;
+	unsigned int cols;
  };

  /*
@@ -171,19 +173,28 @@ static void tca8418_read_keypad(struct 
tca8418_keypad *keypad_data)
  			break;
  		}

-		/* Assume that key code 0 signifies empty FIFO */
-		if (reg <= 0)
-			break;

  		state = reg & KEY_EVENT_VALUE;
  		code  = reg & KEY_EVENT_CODE;

+		/* Key code 0 signifies empty FIFO */
+		if (!code)
+			break;
+
  		row = code / TCA8418_MAX_COLS;
  		col = code % TCA8418_MAX_COLS;

  		row = (col) ? row : row - 1;
  		col = (col) ? col - 1 : TCA8418_MAX_COLS - 1;

+		/* Validate against configured matrix size */
+		if (row >= keypad_data->rows || col >= keypad_data->cols) {
+			dev_err(&keypad_data->client->dev,
+				"invalid key code %d (row %d, col %d)\n",
+				code, row, col);
+			continue;
+		}
+
  		code = MATRIX_SCAN_CODE(row, col, keypad_data->row_shift);
  		input_event(input, EV_MSC, MSC_SCAN, code);
  		input_report_key(input, keymap[code], state);
@@ -298,6 +309,8 @@ static int tca8418_keypad_probe(struct i2c_client 
*client)

  	keypad_data->client = client;
  	keypad_data->row_shift = row_shift;
+	keypad_data->rows = rows;
+	keypad_data->cols = cols;

  	/* Read key lock register, if this fails assume device not present */
  	error = tca8418_read_byte(keypad_data, REG_KEY_LCK_EC, &reg);
-- 
2.34.1