From: haibo.chen@oss.nxp.com
To: Riku Voipio <riku.voipio@iki.fi>, Lee Jones <lee@kernel.org>,
Pavel Machek <pavel@kernel.org>
Cc: linux-leds@vger.kernel.org, linux-kernel@vger.kernel.org,
Haibo Chen <haibo.chen@nxp.com>,
imx@lists.linux.dev, stable@vger.kernel.org
Subject: [PATCH v2 2/4] leds: pca9532: check return value in pca9532_setled()
Date: Wed, 29 Jul 2026 15:43:28 +0800 [thread overview]
Message-ID: <20260729-led-fix-v2-2-09ad218457bd@nxp.com> (raw)
In-Reply-To: <20260729-led-fix-v2-0-09ad218457bd@nxp.com>
From: Haibo Chen <haibo.chen@nxp.com>
pca9532_setled() reads the LED register with i2c_smbus_read_byte_data()
but never checks its return value. On an I2C read failure the function
returns a negative error code (e.g. -EIO) which was silently truncated
into a signed char, then bitwise modified and written back to the
device.
Since one LED register controls four LEDs, writing this bogus value back
corrupts the state of the other three LEDs sharing the same register.
Fixes: e14fa82439d3 ("leds: Add pca9532 led driver")
Cc: stable@vger.kernel.org
Assisted-by: VeroCoder:claude-sonnet-4
Signed-off-by: Haibo Chen <haibo.chen@nxp.com>
---
drivers/leds/leds-pca9532.c | 25 ++++++++++++++-----------
1 file changed, 14 insertions(+), 11 deletions(-)
diff --git a/drivers/leds/leds-pca9532.c b/drivers/leds/leds-pca9532.c
index e8ee17b8bd547a92372a8e74a6781b95ae831fe2..adfb5aa50e8e1f3ca0deb9261d8c9103903ef928 100644
--- a/drivers/leds/leds-pca9532.c
+++ b/drivers/leds/leds-pca9532.c
@@ -159,21 +159,29 @@ static int pca9532_setpwm(struct i2c_client *client, int pwm)
}
/* Set LED routing */
-static void pca9532_setled(struct pca9532_led *led)
+static int pca9532_setled(struct pca9532_led *led)
{
struct i2c_client *client = led->client;
struct pca9532_data *data = i2c_get_clientdata(client);
u8 maxleds = data->chip_info->num_leds;
- char reg;
+ int reg;
+ int ret = 0;
mutex_lock(&data->update_lock);
reg = i2c_smbus_read_byte_data(client, LED_REG(maxleds, led->id));
+ if (reg < 0) {
+ dev_warn(&client->dev, "failed to read LED register: %d\n", reg);
+ ret = reg;
+ goto out;
+ }
/* zero led bits */
reg = reg & ~LED_MASK(led->id);
/* set the new value */
reg = reg | (led->state << LED_SHIFT(led->id));
- i2c_smbus_write_byte_data(client, LED_REG(maxleds, led->id), reg);
+ ret = i2c_smbus_write_byte_data(client, LED_REG(maxleds, led->id), reg);
+out:
mutex_unlock(&data->update_lock);
+ return ret;
}
static int pca9532_set_brightness(struct led_classdev *led_cdev,
@@ -196,8 +204,7 @@ static int pca9532_set_brightness(struct led_classdev *led_cdev,
}
if (led->state == PCA9532_PWM0)
pca9532_setpwm(led->client, PCA9532_PWM_ID_0);
- pca9532_setled(led);
- return err;
+ return pca9532_setled(led);
}
static int pca9532_update_hw_blink(struct pca9532_led *led,
@@ -257,9 +264,7 @@ static int pca9532_set_blink(struct led_classdev *led_cdev,
if (err)
return err;
- pca9532_setled(led);
-
- return 0;
+ return pca9532_setled(led);
}
static int pca9532_event(struct input_dev *dev, unsigned int type,
@@ -334,9 +339,7 @@ static int pca9532_gpio_set_value(struct gpio_chip *gc, unsigned int offset,
else
led->state = PCA9532_ON;
- pca9532_setled(led);
-
- return 0;
+ return pca9532_setled(led);
}
static int pca9532_gpio_get_value(struct gpio_chip *gc, unsigned offset)
--
2.34.1
next prev parent reply other threads:[~2026-07-29 7:40 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-29 7:43 [PATCH v2 0/4] leds: pca9532: fix unchecked I2C reads and unbind use-after-free haibo.chen
2026-07-29 7:43 ` [PATCH v2 1/4] leds: pca9532: check i2c_smbus_read_byte_data() return value haibo.chen
2026-07-29 7:55 ` sashiko-bot
2026-07-29 7:43 ` haibo.chen [this message]
2026-07-29 7:55 ` [PATCH v2 2/4] leds: pca9532: check return value in pca9532_setled() sashiko-bot
2026-07-29 7:43 ` [PATCH v2 3/4] leds: pca9532: check return value in pca9532_gpio_get_value() haibo.chen
2026-07-29 7:52 ` sashiko-bot
2026-07-29 7:43 ` [PATCH v2 4/4] leds: pca9532: fix use-after-free on unbind with N2100 beeper haibo.chen
2026-07-29 7:50 ` sashiko-bot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260729-led-fix-v2-2-09ad218457bd@nxp.com \
--to=haibo.chen@oss.nxp.com \
--cc=haibo.chen@nxp.com \
--cc=imx@lists.linux.dev \
--cc=lee@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-leds@vger.kernel.org \
--cc=pavel@kernel.org \
--cc=riku.voipio@iki.fi \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox