diff mbox series

gpio: mvebu: fix potential user-after-free on probe

Message ID c27a61d66a9ec4e52e0d1820ce9528ffa18ca539.1606743203.git.baruch@tkos.co.il (mailing list archive)
State New, archived
Headers show
Series gpio: mvebu: fix potential user-after-free on probe | expand

Commit Message

Baruch Siach Nov. 30, 2020, 1:33 p.m. UTC
When mvebu_pwm_probe() fails IRQ domain is not released. Move
mvebu_pwm_probe() before IRQ domain registration.

Fixes: 757642f9a584 ("gpio: mvebu: Add limited PWM support")
Reported-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
---

This is split out of the "gpio: mvebu: Armada 8K/7K PWM support" series.
I'll rebase the series v2 on top on this fix.
---
 drivers/gpio/gpio-mvebu.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

Comments

Uwe Kleine-König Nov. 30, 2020, 1:51 p.m. UTC | #1
On Mon, Nov 30, 2020 at 03:33:23PM +0200, Baruch Siach wrote:
> When mvebu_pwm_probe() fails IRQ domain is not released. Move
> mvebu_pwm_probe() before IRQ domain registration.

And now if something with IRQ domain registration fails the pwm stuff
isn't freed?

Best regards
Uwe
Baruch Siach Nov. 30, 2020, 1:55 p.m. UTC | #2
Hi Uwe,

On Mon, Nov 30 2020, Uwe Kleine-König wrote:
> On Mon, Nov 30, 2020 at 03:33:23PM +0200, Baruch Siach wrote:
>> When mvebu_pwm_probe() fails IRQ domain is not released. Move
>> mvebu_pwm_probe() before IRQ domain registration.
>
> And now if something with IRQ domain registration fails the pwm stuff
> isn't freed?

As far as I can see mvebu_pwm_probe() uses devres exclusively to
allocate resources.

baruch
Uwe Kleine-König Nov. 30, 2020, 2:43 p.m. UTC | #3
Hi Baruch,

On Mon, Nov 30, 2020 at 03:55:28PM +0200, Baruch Siach wrote:
> On Mon, Nov 30 2020, Uwe Kleine-König wrote:
> > On Mon, Nov 30, 2020 at 03:33:23PM +0200, Baruch Siach wrote:
> >> When mvebu_pwm_probe() fails IRQ domain is not released. Move
> >> mvebu_pwm_probe() before IRQ domain registration.
> >
> > And now if something with IRQ domain registration fails the pwm stuff
> > isn't freed?
> 
> As far as I can see mvebu_pwm_probe() uses devres exclusively to
> allocate resources.

there is no devm magic in pwmchip_add().

Best regards
Uwe
diff mbox series

Patch

diff --git a/drivers/gpio/gpio-mvebu.c b/drivers/gpio/gpio-mvebu.c
index 433e2c3f3fd5..4a331c8f6b06 100644
--- a/drivers/gpio/gpio-mvebu.c
+++ b/drivers/gpio/gpio-mvebu.c
@@ -1197,6 +1197,13 @@  static int mvebu_gpio_probe(struct platform_device *pdev)
 
 	devm_gpiochip_add_data(&pdev->dev, &mvchip->chip, mvchip);
 
+	/* Some MVEBU SoCs have simple PWM support for GPIO lines */
+	if (IS_ENABLED(CONFIG_PWM)) {
+		err = mvebu_pwm_probe(pdev, mvchip, id);
+		if (err)
+			return err;
+	}
+
 	/* Some gpio controllers do not provide irq support */
 	if (!have_irqs)
 		return 0;
@@ -1254,10 +1261,6 @@  static int mvebu_gpio_probe(struct platform_device *pdev)
 						 mvchip);
 	}
 
-	/* Some MVEBU SoCs have simple PWM support for GPIO lines */
-	if (IS_ENABLED(CONFIG_PWM))
-		return mvebu_pwm_probe(pdev, mvchip, id);
-
 	return 0;
 
 err_domain: