[PATCH 0/2] misc: ti_fpc202: two small fixes

[PATCH 0/2] misc: ti_fpc202: two small fixes

[Felix Gu]

Signed-off-by: Felix Gu <ustc.gu@gmail.com>
---
Felix Gu (2):
      misc: ti_fpc202: fix off-by-one error in port ID bounds check
      misc: ti_fpc202: remove dead code in fpc202_detach_addr()

 drivers/misc/ti_fpc202.c | 12 ++----------
 1 file changed, 2 insertions(+), 10 deletions(-)
---
base-commit: 44982d352c33767cd8d19f8044e7e1161a587ff7
change-id: 20260220-fp202-a85dc5e1ed22

Best regards,
-- 
Felix Gu <ustc.gu@gmail.com>

[PATCH 1/2] misc: ti_fpc202: fix off-by-one error in port ID bounds check

[Felix Gu]

FPC202_NUM_PORTS is 2, valid port IDs should be 0 and 1. A port_id of 2
would incorrectly pass the check, potentially causing out-of-bounds
access to the port-related arrays.

Found by code review, compile pass.

Fixes: 1e5c9b1efa1c ("misc: add FPC202 dual port controller driver")
Signed-off-by: Felix Gu <ustc.gu@gmail.com>
---
 drivers/misc/ti_fpc202.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/misc/ti_fpc202.c b/drivers/misc/ti_fpc202.c
index 8eb2b5ac9850..578feefb77f1 100644
--- a/drivers/misc/ti_fpc202.c
+++ b/drivers/misc/ti_fpc202.c
@@ -366,7 +366,7 @@ static int fpc202_probe(struct i2c_client *client)
 			goto unregister_chans;
 		}
 
-		if (port_id > FPC202_NUM_PORTS) {
+		if (port_id >= FPC202_NUM_PORTS) {
 			dev_err(dev, "port ID %d is out of range!\n", port_id);
 			ret = -EINVAL;
 			goto unregister_chans;

-- 
2.43.0

Re: [PATCH 1/2] misc: ti_fpc202: fix off-by-one error in port ID bounds check

[Romain Gantois]

[-- Attachment #1: Type: text/plain, Size: 1044 bytes --]

On Friday, 20 February 2026 18:20:31 CET Felix Gu wrote:
> FPC202_NUM_PORTS is 2, valid port IDs should be 0 and 1. A port_id of 2
> would incorrectly pass the check, potentially causing out-of-bounds
> access to the port-related arrays.
> 
> Found by code review, compile pass.
> 
> Fixes: 1e5c9b1efa1c ("misc: add FPC202 dual port controller driver")
> Signed-off-by: Felix Gu <ustc.gu@gmail.com>
> ---
> 
>  drivers/misc/ti_fpc202.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/misc/ti_fpc202.c b/drivers/misc/ti_fpc202.c
> index 8eb2b5ac9850..578feefb77f1 100644
> --- a/drivers/misc/ti_fpc202.c
> +++ b/drivers/misc/ti_fpc202.c
> @@ -366,7 +366,7 @@ static int fpc202_probe(struct i2c_client *client)
> 
>  			goto unregister_chans;
>  		
>  		}
> 
> -		if (port_id > FPC202_NUM_PORTS) {
> +		if (port_id >= FPC202_NUM_PORTS) {
> 
>  			dev_err(dev, "port ID %d is out of range!\n", port_id);
>  			ret = -EINVAL;
>  			goto unregister_chans;

Reviewed-by: Romain Gantois <romain.gantois@bootlin.com>


[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

[PATCH 2/2] misc: ti_fpc202: remove dead code in fpc202_detach_addr()

[Felix Gu]

val is assigned from addr_caches, which is a u8 array. So the check will
never be true.

Found by code review, compile pass.

Signed-off-by: Felix Gu <ustc.gu@gmail.com>
---
 drivers/misc/ti_fpc202.c | 10 +---------
 1 file changed, 1 insertion(+), 9 deletions(-)

diff --git a/drivers/misc/ti_fpc202.c b/drivers/misc/ti_fpc202.c
index 578feefb77f1..79a029d79f7a 100644
--- a/drivers/misc/ti_fpc202.c
+++ b/drivers/misc/ti_fpc202.c
@@ -243,23 +243,15 @@ static void fpc202_detach_addr(struct i2c_atr *atr, u32 chan_id,
 			       u16 addr)
 {
 	struct fpc202_priv *priv = i2c_atr_get_driver_data(atr);
-	int dev_num, reg_mod, val;
+	int dev_num, val;
 
 	for (dev_num = 0; dev_num < 2; dev_num++) {
-		reg_mod = FPC202_REG_MOD_DEV(chan_id, dev_num);
-
 		mutex_lock(&priv->reg_dev_lock);
 
 		val = priv->addr_caches[chan_id][dev_num];
 
 		mutex_unlock(&priv->reg_dev_lock);
 
-		if (val < 0) {
-			dev_err(&priv->client->dev, "failed to read register 0x%x while detaching address 0x%02x\n",
-				reg_mod, addr);
-			return;
-		}
-
 		if (val == (addr & 0x7f)) {
 			fpc202_write_dev_addr(priv, chan_id, dev_num, FPC202_REG_DEV_INVALID);
 			return;

-- 
2.43.0

Re: [PATCH 2/2] misc: ti_fpc202: remove dead code in fpc202_detach_addr()

[Romain Gantois]

[-- Attachment #1: Type: text/plain, Size: 1366 bytes --]

On Friday, 20 February 2026 18:20:32 CET Felix Gu wrote:
> val is assigned from addr_caches, which is a u8 array. So the check will
> never be true.
> 
> Found by code review, compile pass.
> 
> Signed-off-by: Felix Gu <ustc.gu@gmail.com>
> ---
> 
>  drivers/misc/ti_fpc202.c | 10 +---------
>  1 file changed, 1 insertion(+), 9 deletions(-)
> 
> diff --git a/drivers/misc/ti_fpc202.c b/drivers/misc/ti_fpc202.c
> index 578feefb77f1..79a029d79f7a 100644
> --- a/drivers/misc/ti_fpc202.c
> +++ b/drivers/misc/ti_fpc202.c
> @@ -243,23 +243,15 @@ static void fpc202_detach_addr(struct i2c_atr *atr,
> u32 chan_id, u16 addr)
> 
>  {
>  
>  	struct fpc202_priv *priv = i2c_atr_get_driver_data(atr);
> 
> -	int dev_num, reg_mod, val;
> +	int dev_num, val;
> 
>  	for (dev_num = 0; dev_num < 2; dev_num++) {
> 
> -		reg_mod = FPC202_REG_MOD_DEV(chan_id, dev_num);
> -
> 
>  		mutex_lock(&priv->reg_dev_lock);
>  		
>  		val = priv->addr_caches[chan_id][dev_num];
>  		
>  		mutex_unlock(&priv->reg_dev_lock);
> 
> -		if (val < 0) {
> -			dev_err(&priv->client->dev, "failed to read register 
0x%x while
> detaching address 0x%02x\n", -				reg_mod, addr);
> -			return;
> -		}
> -
> 
>  		if (val == (addr & 0x7f)) {
>  		
>  			fpc202_write_dev_addr(priv, chan_id, dev_num, 
FPC202_REG_DEV_INVALID);
>  			return;

Reviewed-by: Romain Gantois <romain.gantois@bootlin.com>


[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 833 bytes --]