raspi/linux
1
0
Fork 1
mirror of https://github.com/raspberrypi/linux.git synced 2026-01-04 18:27:36 +00:00
Code Issues Projects Releases Wiki Activity

gpio: ml-ioh: Fix buffer underwrite on probe error path

Browse Source 
[ Upstream commit 4bf4eed44b ]

If ioh_gpio_probe() fails on devm_irq_alloc_descs() then chip may point
to any element of chip_save array, so reverse iteration from pointer chip
may become chip_save[-1] and gpiochip_remove() will operate with wrong
memory.

The patch fix the error path of ioh_gpio_probe() to correctly bypass
chip_save array.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Anton Vasilyev <vasilyev@ispras.ru>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Anton Vasilyev
2018-07-23 19:53:30 +03:00
committed by Greg Kroah-Hartman
parent 1fc16c07d6
commit acd73639c3
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
drivers/gpio/gpio-ml-ioh.c
View File

@@ -497,9 +497,10 @@ static int ioh_gpio_probe(struct pci_dev *pdev,
return 0;
err_gpiochip_add:
chip = chip_save;
while (--i >= 0) {
chip--;
gpiochip_remove(&chip->gpio);
chip++;
}
kfree(chip_save);