[PATCH v2 1/5] mfd: cgbc: Fix use of negative error code as valid session handle
"Thomas Richard (congatec GmbH)" <[email protected]>
| Newsgroups | dev.linux.lists.mfd,org.kernel.vger.linux-i2c,org.kernel.vger.linux-kernel,org.kernel.vger.stable |
|---|---|
| Message-ID | <20260811-cgbc-i2c-storage-devices-support-v2-1-3efa998e0ef5@bootlin.com> |
The cgbc_session_command() return value was directly cast to u8 and used as session handle without error checking. Casting a negative error to u8 produces a valid-looking session handle. So check if return value is positive before to cast and use it. Cc: [email protected] Reported-by: Sashiko <[email protected]> Closes: https://sashiko.dev/#/patchset/20260713-cgbc-core-fix-cgbc-remove-v1-1-79274ad62b3a%40bootlin.com?part=1 Fixes: 6f1067cfbee7 ("mfd: Add Congatec Board Controller driver") Signed-off-by: Thomas Richard (congatec GmbH) <[email protected]> --- drivers/mfd/cgbc-core.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/mfd/cgbc-core.c b/drivers/mfd/cgbc-core.c index 2becaf797646..4a409234e66c 100644 --- a/drivers/mfd/cgbc-core.c +++ b/drivers/mfd/cgbc-core.c @@ -103,7 +103,11 @@ static int cgbc_session_request(struct cgbc_device_data *cgbc) if (ret) return dev_err_probe(cgbc->dev, ret, "device not found or not ready\n"); - cgbc->session = cgbc_session_command(cgbc, CGBC_SESSION_CMD_REQUEST); + ret = cgbc_session_command(cgbc, CGBC_SESSION_CMD_REQUEST); + if (ret < 0) + return dev_err_probe(cgbc->dev, ret, "session handle request timed out\n"); + + cgbc->session = ret; /* The Board Controller sent us a wrong session handle, we cannot communicate with it */ if (cgbc->session < CGBC_SESSION_VALID_MIN || cgbc->session > CGBC_SESSION_VALID_MAX) -- 2.53.0