Commit aaed651f authored by David Woodhouse's avatar David Woodhouse Committed by Linus Walleij

pinctrl: mvebu: prevent walking off the end of group array

While investigating (ab)use of krealloc, David found this bug.  It's
unlikely to occur, but now we detect the condition and error out
appropriately.
Signed-off-by: default avatarDavid Woodhouse <David.Woodhouse@intel.com>
Signed-off-by: default avatarJason Cooper <jason@lakedaemon.net>
Signed-off-by: default avatarSebastian Hesselbarth <sebastian.hesselbarth@gmail.com>
Acked-by: default avatarJason Cooper <jason@lakedaemon.net>
Signed-off-by: default avatarLinus Walleij <linus.walleij@linaro.org>
parent 50cf7c8a
...@@ -478,8 +478,12 @@ static const struct pinctrl_ops mvebu_pinctrl_ops = { ...@@ -478,8 +478,12 @@ static const struct pinctrl_ops mvebu_pinctrl_ops = {
.dt_free_map = mvebu_pinctrl_dt_free_map, .dt_free_map = mvebu_pinctrl_dt_free_map,
}; };
static int _add_function(struct mvebu_pinctrl_function *funcs, const char *name) static int _add_function(struct mvebu_pinctrl_function *funcs, int *funcsize,
const char *name)
{ {
if (*funcsize <= 0)
return -EOVERFLOW;
while (funcs->num_groups) { while (funcs->num_groups) {
/* function already there */ /* function already there */
if (strcmp(funcs->name, name) == 0) { if (strcmp(funcs->name, name) == 0) {
...@@ -488,8 +492,12 @@ static int _add_function(struct mvebu_pinctrl_function *funcs, const char *name) ...@@ -488,8 +492,12 @@ static int _add_function(struct mvebu_pinctrl_function *funcs, const char *name)
} }
funcs++; funcs++;
} }
/* append new unique function */
funcs->name = name; funcs->name = name;
funcs->num_groups = 1; funcs->num_groups = 1;
(*funcsize)--;
return 0; return 0;
} }
...@@ -497,12 +505,12 @@ static int mvebu_pinctrl_build_functions(struct platform_device *pdev, ...@@ -497,12 +505,12 @@ static int mvebu_pinctrl_build_functions(struct platform_device *pdev,
struct mvebu_pinctrl *pctl) struct mvebu_pinctrl *pctl)
{ {
struct mvebu_pinctrl_function *funcs; struct mvebu_pinctrl_function *funcs;
int num = 0; int num = 0, funcsize = pctl->desc.npins;
int n, s; int n, s;
/* we allocate functions for number of pins and hope /* we allocate functions for number of pins and hope
* there are less unique functions than pins available */ * there are fewer unique functions than pins available */
funcs = devm_kzalloc(&pdev->dev, pctl->desc.npins * funcs = devm_kzalloc(&pdev->dev, funcsize *
sizeof(struct mvebu_pinctrl_function), GFP_KERNEL); sizeof(struct mvebu_pinctrl_function), GFP_KERNEL);
if (!funcs) if (!funcs)
return -ENOMEM; return -ENOMEM;
...@@ -510,26 +518,27 @@ static int mvebu_pinctrl_build_functions(struct platform_device *pdev, ...@@ -510,26 +518,27 @@ static int mvebu_pinctrl_build_functions(struct platform_device *pdev,
for (n = 0; n < pctl->num_groups; n++) { for (n = 0; n < pctl->num_groups; n++) {
struct mvebu_pinctrl_group *grp = &pctl->groups[n]; struct mvebu_pinctrl_group *grp = &pctl->groups[n];
for (s = 0; s < grp->num_settings; s++) { for (s = 0; s < grp->num_settings; s++) {
int ret;
/* skip unsupported settings on this variant */ /* skip unsupported settings on this variant */
if (pctl->variant && if (pctl->variant &&
!(pctl->variant & grp->settings[s].variant)) !(pctl->variant & grp->settings[s].variant))
continue; continue;
/* check for unique functions and count groups */ /* check for unique functions and count groups */
if (_add_function(funcs, grp->settings[s].name)) ret = _add_function(funcs, &funcsize,
grp->settings[s].name);
if (ret == -EOVERFLOW)
dev_err(&pdev->dev,
"More functions than pins(%d)\n",
pctl->desc.npins);
if (ret < 0)
continue; continue;
num++; num++;
} }
} }
/* with the number of unique functions and it's groups known,
reallocate functions and assign group names */
funcs = krealloc(funcs, num * sizeof(struct mvebu_pinctrl_function),
GFP_KERNEL);
if (!funcs)
return -ENOMEM;
pctl->num_functions = num; pctl->num_functions = num;
pctl->functions = funcs; pctl->functions = funcs;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment