Re: [PATCH v4 1/9] mfd: cgbc: Fix use of negative error code as valid session handle

[Thomas Richard]

On 10/15/26 5:19 PM, Lee Jones wrote:
> On Fri, 02 Oct 2026, Thomas Richard (congatec GmbH) wrote:
> 
>> The cgbc_session_command() return value was directly cast to u8 and used
>> as session handle without error checking. Casting a negative error to u8
>> produces a valid-looking session handle. So check if return value is
>> positive before to cast and use it.
>>
>> Cc: stable@xxxxxxxxxxxxxxx
>> Reported-by: Sashiko <sashiko-bot@xxxxxxxxxx>
>> Closes: https://sashiko.dev/#/patchset/20260713-cgbc-core-fix-cgbc-remove-v1-1-79274ad62b3a%40bootlin.com?part=1
>> Fixes: 6f1067cfbee7 ("mfd: Add Congatec Board Controller driver")
>> Signed-off-by: Thomas Richard (congatec GmbH) <thomas.richard@xxxxxxxxxxx>
>> ---
>>  drivers/mfd/cgbc-core.c | 6 +++++-
>>  1 file changed, 5 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/mfd/cgbc-core.c b/drivers/mfd/cgbc-core.c
>> index 2becaf797646..4a409234e66c 100644
>> --- a/drivers/mfd/cgbc-core.c
>> +++ b/drivers/mfd/cgbc-core.c
>> @@ -103,7 +103,11 @@ static int cgbc_session_request(struct cgbc_device_data *cgbc)
>>  	if (ret)
>>  		return dev_err_probe(cgbc->dev, ret, "device not found or not ready\n");
>>
>> -	cgbc->session = cgbc_session_command(cgbc, CGBC_SESSION_CMD_REQUEST);
>> +	ret = cgbc_session_command(cgbc, CGBC_SESSION_CMD_REQUEST);
>> +	if (ret < 0)
>> +		return dev_err_probe(cgbc->dev, ret, "session handle request timed out\n");
> 
> As previously requested, can we make this a bit more user friendly?
> 
> "Failed to start XYZ session"
Oh yes, I totally forgot it. Sorry about that.

Best Regards,
Thomas