From patchwork Wed Apr 25 22:43:25 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Timur Tabi X-Patchwork-Id: 10364343 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id BC056602D6 for ; Wed, 25 Apr 2018 22:43:35 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id A90E428BE0 for ; Wed, 25 Apr 2018 22:43:35 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 9CEF928FC1; Wed, 25 Apr 2018 22:43:35 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.8 required=2.0 tests=BAYES_00,DKIM_SIGNED, MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI, T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 402CF28BE0 for ; Wed, 25 Apr 2018 22:43:35 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753774AbeDYWne (ORCPT ); Wed, 25 Apr 2018 18:43:34 -0400 Received: from smtp.codeaurora.org ([198.145.29.96]:51516 "EHLO smtp.codeaurora.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753733AbeDYWnc (ORCPT ); Wed, 25 Apr 2018 18:43:32 -0400 Received: by smtp.codeaurora.org (Postfix, from userid 1000) id 0D89460F6B; Wed, 25 Apr 2018 22:43:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=codeaurora.org; s=default; t=1524696212; bh=0GmFc+ktQUaSaLfKZQEraszBF5MYsQ5jk1zHPFJftSg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=m9xNlSjSSz+f/QXIFMm5MljCVs9QWmwQ4oKkQ9RYpE9LywQtS4W5jivjq68w0Cgwz zcWuvC7eUqayOD0F5qTY0it+LIoIo1KpYKPZgj9u1b7T9eZWNuM9fjwPiL55taYZi0 t4OhLzGfTKgATrrLGOJC7yK500CWQBp7pwbIaN78= Received: from timur-ubuntu.qualcomm.com (i-global254.qualcomm.com [199.106.103.254]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-SHA256 (128/128 bits)) (No client certificate requested) (Authenticated sender: timur@smtp.codeaurora.org) by smtp.codeaurora.org (Postfix) with ESMTPSA id D6E6A6034E; Wed, 25 Apr 2018 22:43:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=codeaurora.org; s=default; t=1524696211; bh=0GmFc+ktQUaSaLfKZQEraszBF5MYsQ5jk1zHPFJftSg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=lYBnVf9WEFH9cm2rZXCJx0OJBIw5rh0hsyz6cNVFCvSDh28wmW7jQmWEvpf9AvrPU ofzlP++W3aKYDXAk4FuFiOW5nYk5mv2oapOEh624JoXcmBtmEuD2ES9UrKiAFt1nHz X82VaTlP99KBrBmujwnT4GXKhOLsmYZMhTZscfic= DMARC-Filter: OpenDMARC Filter v1.3.2 smtp.codeaurora.org D6E6A6034E Authentication-Results: pdx-caf-mail.web.codeaurora.org; dmarc=none (p=none dis=none) header.from=codeaurora.org Authentication-Results: pdx-caf-mail.web.codeaurora.org; spf=none smtp.mailfrom=timur@codeaurora.org From: Timur Tabi To: Linus Walleij , sboyd@kernel.org, Bjorn Andersson , linux-gpio@vger.kernel.org, linux-arm-msm@vger.kernel.org Cc: timur@codeaurora.org Subject: [PATCH 1/3] gpioib: do not free unrequested descriptors Date: Wed, 25 Apr 2018 17:43:25 -0500 Message-Id: <1524696207-5156-2-git-send-email-timur@codeaurora.org> X-Mailer: git-send-email 1.9.1 In-Reply-To: <1524696207-5156-1-git-send-email-timur@codeaurora.org> References: <1524696207-5156-1-git-send-email-timur@codeaurora.org> Sender: linux-arm-msm-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-arm-msm@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP If the main loop in linehandle_create() encounters an error, it unwinds completely by freeing all previously requested GPIO descriptors. However, if the error occurs in the beginning of the loop before that GPIO is requested, then the exit code attempts to free a null descriptor. If extrachecks is enabled, gpiod_free() triggers a WARN_ON. Instead, keep a separate count of legitimate GPIOs so that only those are freed. Cc: stable@vger.kernel.org Fixes: d7c51b47ac11 ("gpio: userspace ABI for reading/writing GPIO lines") Signed-off-by: Timur Tabi Reviewed-by: Bjorn Andersson --- drivers/gpio/gpiolib.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c index 43aeb07343ec..d07771797707 100644 --- a/drivers/gpio/gpiolib.c +++ b/drivers/gpio/gpiolib.c @@ -497,7 +497,7 @@ static int linehandle_create(struct gpio_device *gdev, void __user *ip) struct gpiohandle_request handlereq; struct linehandle_state *lh; struct file *file; - int fd, i, ret; + int fd, i, count = 0, ret; u32 lflags; if (copy_from_user(&handlereq, ip, sizeof(handlereq))) @@ -558,6 +558,7 @@ static int linehandle_create(struct gpio_device *gdev, void __user *ip) if (ret) goto out_free_descs; lh->descs[i] = desc; + count = i; if (lflags & GPIOHANDLE_REQUEST_ACTIVE_LOW) set_bit(FLAG_ACTIVE_LOW, &desc->flags); @@ -628,7 +629,7 @@ static int linehandle_create(struct gpio_device *gdev, void __user *ip) out_put_unused_fd: put_unused_fd(fd); out_free_descs: - for (; i >= 0; i--) + for (i = 0; i < count; i++) gpiod_free(lh->descs[i]); kfree(lh->label); out_free_lh: