Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 264a5cf0 authored by Andy Shevchenko's avatar Andy Shevchenko Committed by Greg Kroah-Hartman
Browse files

pinctrl: at91: Fix possible out-of-boundary access 



[ Upstream commit 762ef7d1e6eefad9896560bfcb9bcf7f1b6df9c1 ]

at91_gpio_probe() doesn't check that given OF alias is not available or
something went wrong when trying to get it. This might have consequences
when accessing gpio_chips array with that value as an index. Note, that
BUG() can be compiled out and hence won't actually perform the required
checks.

Fixes: 6732ae5c ("ARM: at91: add pinctrl support")
Signed-off-by: default avatarAndy Shevchenko <andriy.shevchenko@linux.intel.com>
Closes: https://lore.kernel.org/r/202505052343.UHF1Zo93-lkp@intel.com/
Link: https://lore.kernel.org/20250508200807.1384558-1-andriy.shevchenko@linux.intel.com


Signed-off-by: default avatarLinus Walleij <linus.walleij@linaro.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent ac7fca66

drivers/pinctrl/pinctrl-at91.c

+5 −1
Original line number Diff line number Diff line
@@ -1819,12 +1819,16 @@ static int at91_gpio_probe(struct platform_device *pdev) 
	struct at91_gpio_chip *at91_chip = NULL;

	struct gpio_chip *chip;

	struct pinctrl_gpio_range *range;

	int alias_idx;

	int ret = 0;

	int irq, i;

	int alias_idx = of_alias_get_id(np, "gpio");

	uint32_t ngpio;

	char **names;



	alias_idx = of_alias_get_id(np, "gpio");

	if (alias_idx < 0)

		return alias_idx;



	BUG_ON(alias_idx >= ARRAY_SIZE(gpio_chips));

	if (gpio_chips[alias_idx]) {

		ret = -EBUSY;