Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ad5d25fe authored by Tomi Valkeinen's avatar Tomi Valkeinen Committed by Linus Walleij
Browse files

pinctrl: single: fix infinite loop caused by bad mask 



commit 4e7e8017 (pinctrl: pinctrl-single:
enhance to configure multiple pins of different modules) improved
support for pinctrl-single,bits option, but also caused a regression
in parsing badly configured mask data.

If the masks in DT data are not quite right,
pcs_parse_bits_in_pinctrl_entry() can end up in an infinite loop,
trashing memory at the same time.

Add a check to verify that each loop actually removes bits from the
'mask', so that the loop can eventually end.

Signed-off-by: default avatarTomi Valkeinen <tomi.valkeinen@ti.com>
Acked-by: default avatarTony Lindgren <tony@atomide.com>
Signed-off-by: default avatarLinus Walleij <linus.walleij@linaro.org>
parent dd4c2b3c

drivers/pinctrl/pinctrl-single.c

+8 −0
Original line number Diff line number Diff line
@@ -1318,6 +1318,14 @@ static int pcs_parse_bits_in_pinctrl_entry(struct pcs_device *pcs, 
			mask_pos = ((pcs->fmask) << (bit_pos - 1));

			val_pos = val & mask_pos;

			submask = mask & mask_pos;



			if ((mask & mask_pos) == 0) {

				dev_err(pcs->dev,

					"Invalid mask for %s at 0x%x\n",

					np->name, offset);

				break;

			}



			mask &= ~mask_pos;



			if (submask != mask_pos) {