From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794065127; b=akvhlI9PyRrWSFUzuABpCow0LfvCXCTGfPR0aRiSFw7Z/3IdNCuyfHEsrkhLZZvbmv5R hocFc/uMafOdXPB/sHCjKXZk7CJKr/HZeN0oqtl9Li/77gPUB0ITwNV++W8BMwCsw61r8 8YN+km7oY0m3P1NQrFJkRZsyTezBqgmhy06q3akSUSOaYXaaZN/qFHvfehRbW2SadfnPQ k+vLa31zc/g+38KnIjcCWcuE9hovcS6LoXYhff1elmi7tJMLXHxwlLB9rjaO1Z8S6Nfe3 tWt8nfm8mgN6IkISXJtiDDmDMzDz+Fv25UCcXbR1dBC4vXEBCO3t2Rtmk9j8OD4Z2+w== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794065127; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=Uk1yk6fKKO/ZJUOxvjL6JN4BdqI23E8HjmPPiUJsr7U=; b=ooiwU+QatDOhkVaTBlqU6nllUsFKGlyHVSwHDQ1cHTc4dbZdkHJlNiqcuhR9TPjMIfZn d3Xlqy2PsdAFxjqY6ry8BS+r1+qqj92g4JpgrEe+ICnoegL0hNOSzBHakre9qumV+oLSA 3A/yVNHdZ0aVvn6S+3q8W5T9C1+qJOu8lAyJwThW/wZV3NCSQe2WuDERzZV/XIdsV794L mLfPh3Aha8rR/FDG0nJae/Zz8XoLSktMoK59yOY4S7d/YK1IUhsYLTe/sNTzP++OdlXB2 OT8PP4Sme6vI/KxoyEpGwKa9JedzY7Zq2Zm5RwQmqtzRcrbOWRNQ+6pLbDZtMWfrsQQ== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=Hr2CPTrl; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8B9A8606A32E; Sat, 7 Nov 2026 15:25:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=Hr2CPTrl Received: by smtp.kernel.org (Postfix) with ESMTPSA id 397D31F0089F; Sat, 7 Nov 2026 15:25:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1794065127; bh=Uk1yk6fKKO/ZJUOxvjL6JN4BdqI23E8HjmPPiUJsr7U=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=Hr2CPTrlPye5sNsaBT63zTj7xCh/ea9acCrXOSczI07wPDLtYOT0E9XJtgHfkXL93 eNfkRCRExG2JLfh+FAiNYyfTpgACubLYZKNWS0lnHdrZEfZNqrhCZuCWSzMG6EmhlQ cpo6OkvcSjikrZV4159jtrGTGOTy4DIaBX+d0lV4= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Sahaj Chaudhari , Bartosz Golaszewski , Sasha Levin Subject: [PATCH 7.3 0949/1257] gpio: pca953x: Handle direction register read errors in IRQ paths Date: Sat, 7 Nov 2026 08:54:05 -0500 Message-ID: <20261107135005.557899667@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261107134939.434104957@linuxfoundation.org> References: <20261107134939.434104957@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 7.3-stable review patch. If anyone has any objections, please let me know. ------------------ From: Sahaj Chaudhari [ Upstream commit a0fe269293509acdd93b9cfb3f46636f7b91b33a ] Three IRQ paths ignore the result of reading the direction registers and then use the destination bitmap. pca953x_read_regs() does not populate that bitmap when regmap_bulk_read() fails, leaving the callers to use uninitialized stack data. This can select incorrect GPIOs for direction changes during IRQ bus synchronization, corrupt the saved input state during IRQ setup, or produce incorrect pending interrupt decisions. Check the read result at all three sites. Release irq_lock without changing GPIO directions on failure, leave the IRQ history untouched when pending detection fails, and propagate the error from IRQ setup. The read helper already logs the error. Fixes: 0f25fda840a9 ("gpio: pca953x: Zap ad-hoc reg_direction cache") Cc: stable@vger.kernel.org Signed-off-by: Sahaj Chaudhari Link: https://patch.msgid.link/20261018165003.3372368-1-sahaj123.sc@gmail.com Signed-off-by: Bartosz Golaszewski Signed-off-by: Sasha Levin --- drivers/gpio/gpio-pca953x.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c index 869ed4264d48a..afec5ec236968 100644 --- a/drivers/gpio/gpio-pca953x.c +++ b/drivers/gpio/gpio-pca953x.c @@ -867,6 +867,7 @@ static void pca953x_irq_bus_sync_unlock(struct irq_data *d) DECLARE_BITMAP(irq_mask, MAX_LINE); DECLARE_BITMAP(reg_direction, MAX_LINE); int level; + int ret; guard(mutex)(&chip->i2c_lock); @@ -885,7 +886,9 @@ static void pca953x_irq_bus_sync_unlock(struct irq_data *d) } /* Switch direction to input if needed */ - pca953x_read_regs(chip, chip->regs->direction, reg_direction); + ret = pca953x_read_regs(chip, chip->regs->direction, reg_direction); + if (ret) + goto out; bitmap_or(irq_mask, chip->irq_trig_fall, chip->irq_trig_raise, gc->ngpio); bitmap_or(irq_mask, irq_mask, chip->irq_trig_level_high, gc->ngpio); @@ -895,6 +898,7 @@ static void pca953x_irq_bus_sync_unlock(struct irq_data *d) for_each_andnot_bit(level, irq_mask, reg_direction, gc->ngpio) pca953x_gpio_direction_input_unlocked(&chip->gpio_chip, level); +out: mutex_unlock(&chip->irq_lock); } @@ -989,7 +993,9 @@ static bool pca953x_irq_pending(struct pca953x_chip *chip, unsigned long *pendin } /* Remove output pins from the equation */ - pca953x_read_regs(chip, chip->regs->direction, reg_direction); + ret = pca953x_read_regs(chip, chip->regs->direction, reg_direction); + if (ret) + return false; bitmap_copy(old_stat, chip->irq_stat, gc->ngpio); @@ -1089,7 +1095,9 @@ static int pca953x_irq_setup(struct pca953x_chip *chip, int irq_base) * interrupt. We have to rely on the previous read for * this purpose. */ - pca953x_read_regs(chip, chip->regs->direction, reg_direction); + ret = pca953x_read_regs(chip, chip->regs->direction, reg_direction); + if (ret) + return ret; bitmap_and(chip->irq_stat, irq_stat, reg_direction, gc->ngpio); mutex_init(&chip->irq_lock); -- 2.53.0