From 59b748ac6a130b34b459ad7e4ff50db6a121e0bc Mon Sep 17 00:00:00 2001 From: yujun Date: Mon, 29 Jun 2026 15:41:33 +0800 Subject: [PATCH] hw/gpio/pca9552: fix off-by-one in QOM led index validation MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit pca955x_get_led() and pca955x_set_led() accept led indices equal to pin_count, but valid indices are 0..pin_count-1. For a 16-pin device, led16 passes the current check and then accesses an LS register past max_reg. Use the same >= pin_count bounds check as pca9554_set_pin() and the gpio input handler assert in this file. Fixes: a90d8f84674 ("misc/pca9552: Add qom set and get") Signed-off-by: yujun Reviewed-by: Peter Maydell Reviewed-by: Glenn Miles Message-ID: <20260629074133.187549-1-yujun@kylinos.cn> Signed-off-by: Philippe Mathieu-Daudé --- hw/gpio/pca9552.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/hw/gpio/pca9552.c b/hw/gpio/pca9552.c index 472d8ad957..b13ac9fd9c 100644 --- a/hw/gpio/pca9552.c +++ b/hw/gpio/pca9552.c @@ -311,8 +311,8 @@ static void pca955x_get_led(Object *obj, Visitor *v, const char *name, error_setg(errp, "%s: error reading %s", __func__, name); return; } - if (led < 0 || led > k->pin_count) { - error_setg(errp, "%s invalid led %s", __func__, name); + if (led < 0 || led >= k->pin_count) { + error_setg(errp, "%s: invalid led %s", __func__, name); return; } /* @@ -352,8 +352,8 @@ static void pca955x_set_led(Object *obj, Visitor *v, const char *name, error_setg(errp, "%s: error reading %s", __func__, name); return; } - if (led < 0 || led > k->pin_count) { - error_setg(errp, "%s invalid led %s", __func__, name); + if (led < 0 || led >= k->pin_count) { + error_setg(errp, "%s: invalid led %s", __func__, name); return; }