Skip to content

Commit

Permalink
gpiolib: sanitize flags before allocating memory in lineevent_create()
Browse files Browse the repository at this point in the history
Move all the flags sanitization before any memory allocation in
lineevent_create() in order to remove a couple unneeded gotos.

Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
  • Loading branch information
brgl committed Oct 8, 2019
1 parent da0c9ea commit f6cfbbe
Showing 1 changed file with 18 additions and 24 deletions.
42 changes: 18 additions & 24 deletions drivers/gpio/gpiolib.c
Expand Up @@ -893,6 +893,24 @@ static int lineevent_create(struct gpio_device *gdev, void __user *ip)

if (copy_from_user(&eventreq, ip, sizeof(eventreq)))
return -EFAULT;

offset = eventreq.lineoffset;
lflags = eventreq.handleflags;
eflags = eventreq.eventflags;

if (offset >= gdev->ngpio)
return -EINVAL;

/* Return an error if a unknown flag is set */
if ((lflags & ~GPIOHANDLE_REQUEST_VALID_FLAGS) ||
(eflags & ~GPIOEVENT_REQUEST_VALID_FLAGS))
return -EINVAL;

/* This is just wrong: we don't look for events on output lines */
if ((lflags & GPIOHANDLE_REQUEST_OUTPUT) ||
(lflags & GPIOHANDLE_REQUEST_OPEN_DRAIN) ||
(lflags & GPIOHANDLE_REQUEST_OPEN_SOURCE))
return -EINVAL;

le = kzalloc(sizeof(*le), GFP_KERNEL);
if (!le)
Expand All @@ -911,30 +929,6 @@ static int lineevent_create(struct gpio_device *gdev, void __user *ip)
}
}

offset = eventreq.lineoffset;
lflags = eventreq.handleflags;
eflags = eventreq.eventflags;

if (offset >= gdev->ngpio) {
ret = -EINVAL;
goto out_free_label;
}

/* Return an error if a unknown flag is set */
if ((lflags & ~GPIOHANDLE_REQUEST_VALID_FLAGS) ||
(eflags & ~GPIOEVENT_REQUEST_VALID_FLAGS)) {
ret = -EINVAL;
goto out_free_label;
}

/* This is just wrong: we don't look for events on output lines */
if ((lflags & GPIOHANDLE_REQUEST_OUTPUT) ||
(lflags & GPIOHANDLE_REQUEST_OPEN_DRAIN) ||
(lflags & GPIOHANDLE_REQUEST_OPEN_SOURCE)) {
ret = -EINVAL;
goto out_free_label;
}

desc = &gdev->descs[offset];
ret = gpiod_request(desc, le->label);
if (ret)
Expand Down

0 comments on commit f6cfbbe

Please sign in to comment.