Skip to content

Commit 6476aac

Browse files
andy-shevgregkh
authored andcommitted
pinctrl: pinconf-generic: Fully validate 'pinmux' property
[ Upstream commit c98324e ] The pinconf_generic_parse_dt_pinmux() assumes that the 'pinmux' property is not empty when present. This might be not true. With that, the allocator will give a special value in return and not NULL which lead to the crash when trying to access that (invalid) memory. Fix that by fully validating 'pinmux' value, including its length. Fixes: 7112c05 ("pinctrl: pinconf-generic: Add API for pinmux propertity in DTS file") Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Signed-off-by: Linus Walleij <linusw@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
1 parent be787fe commit 6476aac

1 file changed

Lines changed: 6 additions & 1 deletion

File tree

drivers/pinctrl/pinconf-generic.c

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -261,12 +261,17 @@ int pinconf_generic_parse_dt_pinmux(struct device_node *np, struct device *dev,
261261
return -ENOENT;
262262
}
263263

264+
npins_t = prop->length / sizeof(u32);
265+
if (npins_t == 0) {
266+
dev_info(dev, "pinmux property doesn't have entries\n");
267+
return -ENODATA;
268+
}
269+
264270
if (!pid || !pmux || !npins) {
265271
dev_err(dev, "parameters error\n");
266272
return -EINVAL;
267273
}
268274

269-
npins_t = prop->length / sizeof(u32);
270275
pid_t = devm_kcalloc(dev, npins_t, sizeof(*pid_t), GFP_KERNEL);
271276
pmux_t = devm_kcalloc(dev, npins_t, sizeof(*pmux_t), GFP_KERNEL);
272277
if (!pid_t || !pmux_t) {

0 commit comments

Comments
 (0)