Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 969f07b4 authored by Josh Cartwright's avatar Josh Cartwright Committed by Linus Walleij
Browse files

gpio: use kzalloc to allocate gpio_device 



The use of kmalloc() to allocate the gpio_device leaves the contained struct
device object in an unknown state.  Calling dev_set_name() on a struct device
of unknown state can trigger the free() of an invalid pointer, as seen in the
following backtrace (collected by Tony Lindgren):

  kfree
  kobject_set_name_vargs
  dev_set_name
  gpiochip_add_data
  omap_gpio_probe
  platform_drv_probe
  ...

Reported-by: default avatarGeert Uytterhoeven <geert+renesas@glider.be>
Reported-by: default avatarMichael Welling <mwelling@ieee.org>
Reported-by: default avatarTony Lindgren <tony@atomide.com>
Tested-by: default avatarMichael Welling <mwelling@ieee.org>
Tested-by: default avatarTony Lindgren <tony@atomide.com>
Signed-off-by: default avatarJosh Cartwright <joshc@ni.com>
Signed-off-by: default avatarLinus Walleij <linus.walleij@linaro.org>
parent aaf2b3af

drivers/gpio/gpiolib.c

+1 −1
Original line number Diff line number Diff line
@@ -435,7 +435,7 @@ int gpiochip_add_data(struct gpio_chip *chip, void *data) 
	 * First: allocate and populate the internal stat container, and

	 * set up the struct device.

	 */

	gdev = kmalloc(sizeof(*gdev), GFP_KERNEL);

	gdev = kzalloc(sizeof(*gdev), GFP_KERNEL);

	if (!gdev)

		return -ENOMEM;

	gdev->dev.bus = &gpio_bus_type;