Skip to contentSkip to conversation

gpio: mvebu: validate ngpios before use

PATCH Superseded Rosen Penev 2 participants 4 messages Jul 7 – Jul 9 GPIO

v1 of 3 Superseded Latest is v3 →

lore
Share & tools
lore

Rosen Penev

author
#0 lore raw

PATCH 1/1 gpio: mvebu: validate ngpios before use

If ngpios is read as 0 from device tree, it is passed via irq_alloc_domain_generic_chips() as irqs_per_chip, which leads to a division by zero in DIV_ROUND_UP(d->revmap_size, irqs_per_chip). Reject ngpios == 0 early.

Fixes fefe7b0923459 ("gpio: introduce gpio-mvebu driver for Marvell SoCs")
Assisted-by opencode:big-pickle
Signed-off-by Rosen Penev <[email protected]>
---
 drivers/gpio/gpio-mvebu.c | 5 +++++
 1 file changed, 5 insertions(+)
drivers/gpio/gpio-mvebu.c +5 -0
index 39c1a13e1b65..c7cbfbfb4800 100644
@@ -1175,6 +1175,11 @@ static int mvebu_gpio_probe(struct platform_device *pdev)
 		return -ENODEV;
 	}
 
+	if (!ngpios) {
+		dev_err(&pdev->dev, "ngpios must be greater than 0\n");
+		return -EINVAL;
+	}
+
 	id = of_alias_get_id(pdev->dev.of_node, "gpio");
 	if (id < 0) {
 		dev_err(&pdev->dev, "Couldn't get OF id\n");
Signature · 1 line
2.55.0
maintainer
#1 lore raw
Quoted 17 lines · Rosen Penev

If ngpios is read as 0 from device tree, it is passed via irq_alloc_domain_generic_chips() as irqs_per_chip, which leads to a division by zero in DIV_ROUND_UP(d->revmap_size, irqs_per_chip). Reject ngpios == 0 early.

Fixes fefe7b0923459 ("gpio: introduce gpio-mvebu driver for Marvell SoCs")
Assisted-by opencode:big-pickle
Signed-off-by Rosen Penev <[email protected]>
---
 drivers/gpio/gpio-mvebu.c | 5 +++++
 1 file changed, 5 insertions(+)
drivers/gpio/gpio-mvebu.c +0 -0
index 39c1a13e1b65..c7cbfbfb4800 100644

drivers/gpio/gpio-mvebu.c static int mvebu_gpio_probe(struct platform_device *pdev) · line 1179

Quoted 5 lines
drivers/gpio/gpio-mvebu.c +2 -0
@@ -1175,6 +1175,11 @@ static int mvebu_gpio_probe(struct platform_device *pdev)
 		return -ENODEV;
 	}
 
+	if (!ngpios) {
+		dev_err(&pdev->dev, "ngpios must be greater than 0\n");

return dev_err_probe()?

Quoted 10 lines
drivers/gpio/gpio-mvebu.c +3 -1
+		return -EINVAL;
+	}
+
 	id = of_alias_get_id(pdev->dev.of_node, "gpio");
 	if (id < 0) {
 		dev_err(&pdev->dev, "Couldn't get OF id\n");
--

2.55.0

author
#2 lore raw
Quoted 22 lines · Bartosz Golaszewski
Quoted 20 lines · Rosen Penev

If ngpios is read as 0 from device tree, it is passed via irq_alloc_domain_generic_chips() as irqs_per_chip, which leads to a division by zero in DIV_ROUND_UP(d->revmap_size, irqs_per_chip). Reject ngpios == 0 early.

Fixes fefe7b0923459 ("gpio: introduce gpio-mvebu driver for Marvell SoCs")
Assisted-by opencode:big-pickle
Signed-off-by Rosen Penev <[email protected]>
---
 drivers/gpio/gpio-mvebu.c | 5 +++++
 1 file changed, 5 insertions(+)
drivers/gpio/gpio-mvebu.c +0 -0
index 39c1a13e1b65..c7cbfbfb4800 100644
@@ -1175,6 +1175,11 @@ static int mvebu_gpio_probe(struct platform_device *pdev)
              return -ENODEV;
      }
Quoted 2 lines

drivers/gpio/gpio-mvebu.c static int mvebu_gpio_probe(struct platform_device *pdev) · line 1179

Quoted 2 lines
drivers/gpio/gpio-mvebu.c +2 -0
+     if (!ngpios) {
+             dev_err(&pdev->dev, "ngpios must be greater than 0\n");

Sashiko suggests upper limit bound as well.

Quoted 2 lines

return dev_err_probe()?

surrounding code doesn't use it. dev_err_probe is mostly useful with variable error codes anyway.

Quoted 11 lines
Quoted 11 lines
drivers/gpio/gpio-mvebu.c +3 -1
+             return -EINVAL;
+     }
+
      id = of_alias_get_id(pdev->dev.of_node, "gpio");
      if (id < 0) {
              dev_err(&pdev->dev, "Couldn't get OF id\n");
--

2.55.0

maintainer
#3 lore raw
Quoted 23 lines · Rosen Penev
Quoted 22 lines · Bartosz Golaszewski
Quoted 20 lines · Rosen Penev

If ngpios is read as 0 from device tree, it is passed via irq_alloc_domain_generic_chips() as irqs_per_chip, which leads to a division by zero in DIV_ROUND_UP(d->revmap_size, irqs_per_chip). Reject ngpios == 0 early.

Fixes fefe7b0923459 ("gpio: introduce gpio-mvebu driver for Marvell SoCs")
Assisted-by opencode:big-pickle
Signed-off-by Rosen Penev <[email protected]>
---
 drivers/gpio/gpio-mvebu.c | 5 +++++
 1 file changed, 5 insertions(+)
drivers/gpio/gpio-mvebu.c +0 -0
index 39c1a13e1b65..c7cbfbfb4800 100644
@@ -1175,6 +1175,11 @@ static int mvebu_gpio_probe(struct platform_device *pdev)
              return -ENODEV;
      }
Quoted 7 lines
Quoted 2 lines

drivers/gpio/gpio-mvebu.c static int mvebu_gpio_probe(struct platform_device *pdev) · line 1179

Quoted 2 lines
drivers/gpio/gpio-mvebu.c +2 -0
+     if (!ngpios) {
+             dev_err(&pdev->dev, "ngpios must be greater than 0\n");

Sashiko suggests upper limit bound as well.

Quoted 2 lines

return dev_err_probe()?

surrounding code doesn't use it. dev_err_probe is mostly useful with variable error codes anyway.

It doesn't use it becuase it didn't exist when this driver was written. If you're touching it, you may as well use the more recent interface which saves you a couple lines.

Bart

Quoted 12 lines
Quoted 11 lines
Quoted 11 lines
drivers/gpio/gpio-mvebu.c +3 -1
+             return -EINVAL;
+     }
+
      id = of_alias_get_id(pdev->dev.of_node, "gpio");
      if (id < 0) {
              dev_err(&pdev->dev, "Couldn't get OF id\n");
--

2.55.0