Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 504c7697 authored by Anton Vasilyev's avatar Anton Vasilyev Committed by Linus Walleij
Browse files

pinctrl: axp209: Fix NULL pointer dereference after allocation 



There is no check that allocation in axp20x_funcs_groups_from_mask
is successful.
The patch adds corresponding check and return values.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: default avatarAnton Vasilyev <vasilyev@ispras.ru>
Acked-by: default avatarChen-Yu Tsai <wens@csie.org>
Signed-off-by: default avatarLinus Walleij <linus.walleij@linaro.org>
parent 01f1974e

drivers/pinctrl/pinctrl-axp209.c

+20 −6
Original line number Diff line number Diff line
@@ -316,7 +316,7 @@ static const struct pinctrl_ops axp20x_pctrl_ops = { 
	.get_group_pins		= axp20x_group_pins,

};



static void axp20x_funcs_groups_from_mask(struct device *dev, unsigned int mask,

static int axp20x_funcs_groups_from_mask(struct device *dev, unsigned int mask,

					  unsigned int mask_len,

					  struct axp20x_pinctrl_function *func,

					  const struct pinctrl_pin_desc *pins)
@@ -331,18 +331,22 @@ static void axp20x_funcs_groups_from_mask(struct device *dev, unsigned int mask, 
		func->groups = devm_kcalloc(dev,

					    ngroups, sizeof(const char *),

					    GFP_KERNEL);

		if (!func->groups)

			return -ENOMEM;

		group = func->groups;

		for_each_set_bit(bit, &mask_cpy, mask_len) {

			*group = pins[bit].name;

			group++;

		}

	}



	return 0;

}



static void axp20x_build_funcs_groups(struct platform_device *pdev)

static int axp20x_build_funcs_groups(struct platform_device *pdev)

{

	struct axp20x_pctl *pctl = platform_get_drvdata(pdev);

	int i, pin, npins = pctl->desc->npins;

	int i, ret, pin, npins = pctl->desc->npins;



	pctl->funcs[AXP20X_FUNC_GPIO_OUT].name = "gpio_out";

	pctl->funcs[AXP20X_FUNC_GPIO_OUT].muxval = AXP20X_MUX_GPIO_OUT;
@@ -366,13 +370,19 @@ static void axp20x_build_funcs_groups(struct platform_device *pdev) 
			pctl->funcs[i].groups[pin] = pctl->desc->pins[pin].name;

	}



	axp20x_funcs_groups_from_mask(&pdev->dev, pctl->desc->ldo_mask,

	ret = axp20x_funcs_groups_from_mask(&pdev->dev, pctl->desc->ldo_mask,

				      npins, &pctl->funcs[AXP20X_FUNC_LDO],

				      pctl->desc->pins);

	if (ret)

		return ret;



	axp20x_funcs_groups_from_mask(&pdev->dev, pctl->desc->adc_mask,

	ret = axp20x_funcs_groups_from_mask(&pdev->dev, pctl->desc->adc_mask,

				      npins, &pctl->funcs[AXP20X_FUNC_ADC],

				      pctl->desc->pins);

	if (ret)

		return ret;



	return 0;

}



static const struct of_device_id axp20x_pctl_match[] = {
@@ -424,7 +434,11 @@ static int axp20x_pctl_probe(struct platform_device *pdev) 


	platform_set_drvdata(pdev, pctl);



	axp20x_build_funcs_groups(pdev);

	ret = axp20x_build_funcs_groups(pdev);

	if (ret) {

		dev_err(&pdev->dev, "failed to build groups\n");

		return ret;

	}



	pctrl_desc = devm_kzalloc(&pdev->dev, sizeof(*pctrl_desc), GFP_KERNEL);

	if (!pctrl_desc)