[PATCH] Input: stmpe-keypad - disable keypad on probe failure

[PATCH] Input: stmpe-keypad - disable keypad on probe failure

[Myeonghun Pak]

stmpe_keypad_chip_init() enables the keypad block before programming
its registers. If any subsequent register access fails, the function
returns without disabling the block. The later IRQ request and input
device registration failures have the same problem.

Route every failure after a successful stmpe_enable() through a cleanup
path so a failed probe does not leave the keypad block enabled.

This issue was identified during our ongoing static-analysis research while
reviewing kernel code.

Fixes: 76f10845318b ("input: Add STMPE keypad driver")
Cc: stable@vger.kernel.org
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
---
 drivers/input/keyboard/stmpe-keypad.c | 38 ++++++++++++++++++---------
 1 file changed, 26 insertions(+), 12 deletions(-)

diff --git a/drivers/input/keyboard/stmpe-keypad.c b/drivers/input/keyboard/stmpe-keypad.c
index 0acded4fb9c9c..58a5ce4eaa80b 100644
--- a/drivers/input/keyboard/stmpe-keypad.c
+++ b/drivers/input/keyboard/stmpe-keypad.c
@@ -280,35 +280,44 @@ static int stmpe_keypad_chip_init(struct stmpe_keypad *keypad)
 
 	ret = stmpe_keypad_altfunc_init(keypad);
 	if (ret < 0)
-		return ret;
+		goto disable_keypad;
 
 	ret = stmpe_reg_write(stmpe, STMPE_KPC_COL, keypad->cols);
 	if (ret < 0)
-		return ret;
+		goto disable_keypad;
 
 	ret = stmpe_reg_write(stmpe, STMPE_KPC_ROW_LSB, keypad->rows);
 	if (ret < 0)
-		return ret;
+		goto disable_keypad;
 
 	if (variant->max_rows > 8) {
 		ret = stmpe_set_bits(stmpe, STMPE_KPC_ROW_MSB,
 				     STMPE_KPC_ROW_MSB_ROWS,
 				     keypad->rows >> 8);
 		if (ret < 0)
-			return ret;
+			goto disable_keypad;
 	}
 
 	ret = stmpe_set_bits(stmpe, STMPE_KPC_CTRL_MSB,
 			     STMPE_KPC_CTRL_MSB_SCAN_COUNT,
 			     keypad->scan_count << 4);
 	if (ret < 0)
-		return ret;
+		goto disable_keypad;
+
+	ret = stmpe_set_bits(stmpe, STMPE_KPC_CTRL_LSB,
+			     STMPE_KPC_CTRL_LSB_SCAN |
+			     STMPE_KPC_CTRL_LSB_DEBOUNCE,
+			     STMPE_KPC_CTRL_LSB_SCAN |
+			     (keypad->debounce_ms << 1));
+	if (ret < 0)
+		goto disable_keypad;
 
-	return stmpe_set_bits(stmpe, STMPE_KPC_CTRL_LSB,
-			      STMPE_KPC_CTRL_LSB_SCAN |
-			      STMPE_KPC_CTRL_LSB_DEBOUNCE,
-			      STMPE_KPC_CTRL_LSB_SCAN |
-			      (keypad->debounce_ms << 1));
+	return 0;
+
+disable_keypad:
+	stmpe_disable(stmpe, STMPE_BLOCK_KEYPAD);
+
+	return ret;
 }
 
 static void stmpe_keypad_fill_used_pins(struct stmpe_keypad *keypad,
@@ -389,19 +398,24 @@ static int stmpe_keypad_probe(struct platform_device *pdev)
 					  IRQF_ONESHOT, "stmpe-keypad", keypad);
 	if (error) {
 		dev_err(&pdev->dev, "unable to get irq: %d\n", error);
-		return error;
+		goto disable_keypad;
 	}
 
 	error = input_register_device(input);
 	if (error) {
 		dev_err(&pdev->dev,
 			"unable to register input device: %d\n", error);
-		return error;
+		goto disable_keypad;
 	}
 
 	platform_set_drvdata(pdev, keypad);
 
 	return 0;
+
+disable_keypad:
+	stmpe_disable(stmpe, STMPE_BLOCK_KEYPAD);
+
+	return error;
 }
 
 static void stmpe_keypad_remove(struct platform_device *pdev)
-- 
2.47.1

Re: [PATCH] Input: stmpe-keypad - disable keypad on probe failure

[Dmitry Torokhov]

Hi Myeonghun,

On Tue, Aug 04, 2026 at 11:15:25PM +0900, Myeonghun Pak wrote:
> stmpe_keypad_chip_init() enables the keypad block before programming
> its registers. If any subsequent register access fails, the function
> returns without disabling the block. The later IRQ request and input
> device registration failures have the same problem.

What exactly is the problem with leaving keyboard block enabled? 

Thanks.

-- 
Dmitry