[PATCH] Input: tca8418_keypad - fix potential infinite loop and OOB, access on I2C error

[PATCH] Input: tca8418_keypad - fix potential infinite loop and OOB, access on I2C error

[Liang Zhan]

 From 187224ee38e19fd3f74bfc08d1908c97398fef82 Mon Sep 17 00:00:00 2001
From: Zhian Liang <liangzhan5dev@gmail.com>
Date: Thu, 23 Jul 2026 00:08:15 +0800
Subject: [PATCH] Input: tca8418_keypad - fix potential infinite loop and OOB
  access on I2C error
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
If the I2C bus returns 0xFF (e.g., due to a stuck bus or device fault),
the original code would treat it as a valid key event, leading to two
critical issues:
1. The loop in tca8418_read_keypad() would never terminate because the
    condition "reg <= 0" is false for 0xFF (255). This stalls the threaded
    IRQ handler indefinitely.
2. The extracted hardware keycode (127) is used to compute row/col
    indices that exceed the valid range (rows*cols ≤ 80), causing an
    out-of-bounds read on "keymap[code]" when reporting the key.
Fix both by:
- Recognizing 0xFF as an empty FIFO condition (along with 0x00).
- Validating the keycode before calculating row/col, skipping invalid
   codes and preventing array overrun.
Cc: stable@vger.kernel.org
Signed-off-by: Zhian Liang <liangzhan5dev@gmail.com>
---
  drivers/input/keyboard/tca8418_keypad.c | 11 +++++++++--
  1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/drivers/input/keyboard/tca8418_keypad.c 
b/drivers/input/keyboard/tca8418_keypad.c
index b124e576feca..cec6a589192d 100644
--- a/drivers/input/keyboard/tca8418_keypad.c
+++ b/drivers/input/keyboard/tca8418_keypad.c
@@ -171,13 +171,20 @@ static void tca8418_read_keypad(struct 
tca8418_keypad *keypad_data)
             break;
         }
-       /* Assume that key code 0 signifies empty FIFO */
-       if (reg <= 0)
+       /* 0x00 =  empty FIFO, 0xFF = likely bus fault */
+       if (reg == 0 || reg == 0xFF)
             break;
         state = reg & KEY_EVENT_VALUE;
         code  = reg & KEY_EVENT_CODE;
+       /* validate keycode: must be non-zero and within hardware limits */
+       if (code == 0 || code > TCA8418_MAX_ROWS * TCA8418_MAX_COLS){
+           dev_err(&keypad_data->client->dev,
+               "invalid key code: %d\n", code);
+           continue;
+       }
+
         row = code / TCA8418_MAX_COLS;
         col = code % TCA8418_MAX_COLS;
-- 
2.34.1