p71924506
/
linux_old1
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

gpio: ml-ioh: Fix buffer underwrite on probe error path 

If ioh_gpio_probe() fails on devm_irq_alloc_descs() then chip may point
to any element of chip_save array, so reverse iteration from pointer chip
may become chip_save[-1] and gpiochip_remove() will operate with wrong
memory.

The patch fix the error path of ioh_gpio_probe() to correctly bypass
chip_save array.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Anton Vasilyev <vasilyev@ispras.ru>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
This commit is contained in:
Anton Vasilyev 2018-07-23 19:53:30 +03:00 committed by Linus Walleij
parent 1777fc9730
commit 4bf4eed44b
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
drivers/gpio/gpio-ml-ioh.c
View File

@ -496,9 +496,10 @@ static int ioh_gpio_probe(struct pci_dev *pdev,
return 0;
err_gpiochip_add:
chip = chip_save;
while (--i >= 0) {
chip--;
gpiochip_remove(&chip->gpio);
chip++;
}
kfree(chip_save);