From patchwork Mon Aug 20 18:48:40 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Fabio Estevam X-Patchwork-Id: 1350711 Return-Path: X-Original-To: patchwork-linux-input@patchwork.kernel.org Delivered-To: patchwork-process-083081@patchwork1.kernel.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by patchwork1.kernel.org (Postfix) with ESMTP id 072E33FC33 for ; Mon, 20 Aug 2012 18:48:58 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753221Ab2HTSs5 (ORCPT ); Mon, 20 Aug 2012 14:48:57 -0400 Received: from db3ehsobe002.messaging.microsoft.com ([213.199.154.140]:4052 "EHLO db3outboundpool.messaging.microsoft.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753208Ab2HTSs4 (ORCPT ); Mon, 20 Aug 2012 14:48:56 -0400 Received: from mail87-db3-R.bigfish.com (10.3.81.236) by DB3EHSOBE007.bigfish.com (10.3.84.27) with Microsoft SMTP Server id 14.1.225.23; Mon, 20 Aug 2012 18:48:54 +0000 Received: from mail87-db3 (localhost [127.0.0.1]) by mail87-db3-R.bigfish.com (Postfix) with ESMTP id CF952200EA; Mon, 20 Aug 2012 18:48:54 +0000 (UTC) X-Forefront-Antispam-Report: CIP:70.37.183.190; KIP:(null); UIP:(null); IPV:NLI; H:mail.freescale.net; RD:none; EFVD:NLI X-SpamScore: 5 X-BigFish: VS5(zz78fbmzz1202hzz8275bhz2dh2a8h668h839hd24he5bhf0ah107ah1155h) Received: from mail87-db3 (localhost.localdomain [127.0.0.1]) by mail87-db3 (MessageSwitch) id 1345488532880563_3460; Mon, 20 Aug 2012 18:48:52 +0000 (UTC) Received: from DB3EHSMHS004.bigfish.com (unknown [10.3.81.242]) by mail87-db3.bigfish.com (Postfix) with ESMTP id C98F7160049; Mon, 20 Aug 2012 18:48:52 +0000 (UTC) Received: from mail.freescale.net (70.37.183.190) by DB3EHSMHS004.bigfish.com (10.3.87.104) with Microsoft SMTP Server (TLS) id 14.1.225.23; Mon, 20 Aug 2012 18:48:50 +0000 Received: from tx30smr01.am.freescale.net (10.81.153.31) by 039-SN1MMR1-001.039d.mgd.msft.net (10.84.1.13) with Microsoft SMTP Server (TLS) id 14.2.309.3; Mon, 20 Aug 2012 13:48:49 -0500 Received: from fabio-Latitude-E6410.am.freescale.net ([10.29.240.141]) by tx30smr01.am.freescale.net (8.14.3/8.14.0) with ESMTP id q7KIml4h025912; Mon, 20 Aug 2012 11:48:47 -0700 From: Fabio Estevam To: CC: , , , Fabio Estevam Subject: [PATCH v2] Input: gpio_keys - fix NULL pointer dereference for dt case Date: Mon, 20 Aug 2012 15:48:40 -0300 Message-ID: <1345488520-3997-1-git-send-email-fabio.estevam@freescale.com> X-Mailer: git-send-email 1.7.9.5 MIME-Version: 1.0 X-OriginatorOrg: freescale.com Sender: linux-input-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-input@vger.kernel.org Commit 30161f6b2e7d1 (Input: gpio_keys - clean up device tree parser) introduced the following kernel crash for a dt based kernel: .. Unable to handle kernel NULL pointer dereference at virtual address 00000004 pgd = 80004000 [00000004] *pgd=00000000 Internal error: Oops: 805 [#1] ARM Modules linked in: CPU: 0 Not tainted (3.5.0-next-20120802+ #1366) PC is at gpio_keys_probe+0x154/0x8c0 LR is at of_gpiochip_find_and_xlate+0x54/0x70 pc : [<803ddbac>] lr : [<801ed2f4>] psr: 60000013 sp : 9f851df8 ip : 00000002 fp : 9f851e5c r10: 9f873d00 r9 : 00000001 r8 : 9fa2f900 r7 : 809c0920 r6 : 9f873d08 r5 : 00000000 r4 : 809c09d4 r3 : 805af10c r2 : 000000c0 r1 : 9f851db4 r0 : 000000d5 Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment kernel Control: 10c5387d Table: 90004019 DAC: 00000015 Process swapper (pid: 1, stack limit = 0x9f8502e8) Stack: (0x9f851df8 to 0x9f852000) .... The reason for the crash was due to 'button = &pdata->buttons[i++];' returning a NULL pointer, and then 'button' was accessed afterwards without checking for NULL. Fix this by correctly assigning 'pdata->buttons' and also add a NULL pointer check for 'button' pointer. Signed-off-by: Fabio Estevam Tested-by: Alan M Butler --- Changes since v1: - Fix the location of 'button = pdata->buttons'. This fixes the probing of multiple keys. drivers/input/keyboard/gpio_keys.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/drivers/input/keyboard/gpio_keys.c b/drivers/input/keyboard/gpio_keys.c index 6ee68ec..c90c152 100644 --- a/drivers/input/keyboard/gpio_keys.c +++ b/drivers/input/keyboard/gpio_keys.c @@ -559,7 +559,6 @@ gpio_keys_get_devtree_pdata(struct device *dev) struct gpio_keys_button *button; int error; int nbuttons; - int i; node = dev->of_node; if (!node) { @@ -580,9 +579,12 @@ gpio_keys_get_devtree_pdata(struct device *dev) goto err_out; } + pdata->buttons = (struct gpio_keys_button *) (pdata + 1); + pdata->nbuttons = nbuttons; + pdata->rep = !!of_get_property(node, "autorepeat", NULL); + button = pdata->buttons; - i = 0; for_each_child_of_node(node, pp) { enum of_gpio_flags flags; @@ -592,7 +594,10 @@ gpio_keys_get_devtree_pdata(struct device *dev) continue; } - button = &pdata->buttons[i++]; + if (!button) { + error = -ENOMEM; + goto err_free_pdata; + } button->gpio = of_get_gpio_flags(pp, 0, &flags); button->active_low = flags & OF_GPIO_ACTIVE_LOW; @@ -614,6 +619,8 @@ gpio_keys_get_devtree_pdata(struct device *dev) if (of_property_read_u32(pp, "debounce-interval", &button->debounce_interval)) button->debounce_interval = 5; + + button++; } if (pdata->nbuttons == 0) {