| Message ID | c27a61d66a9ec4e52e0d1820ce9528ffa18ca539.1606743203.git.baruch@tkos.co.il |
|---|---|
| State | New |
| Headers | show |
| Series | gpio: mvebu: fix potential user-after-free on probe | expand |
On Mon, Nov 30, 2020 at 03:33:23PM +0200, Baruch Siach wrote: > When mvebu_pwm_probe() fails IRQ domain is not released. Move > mvebu_pwm_probe() before IRQ domain registration. And now if something with IRQ domain registration fails the pwm stuff isn't freed? Best regards Uwe
Hi Uwe, On Mon, Nov 30 2020, Uwe Kleine-König wrote: > On Mon, Nov 30, 2020 at 03:33:23PM +0200, Baruch Siach wrote: >> When mvebu_pwm_probe() fails IRQ domain is not released. Move >> mvebu_pwm_probe() before IRQ domain registration. > > And now if something with IRQ domain registration fails the pwm stuff > isn't freed? As far as I can see mvebu_pwm_probe() uses devres exclusively to allocate resources. baruch
Hi Baruch, On Mon, Nov 30, 2020 at 03:55:28PM +0200, Baruch Siach wrote: > On Mon, Nov 30 2020, Uwe Kleine-König wrote: > > On Mon, Nov 30, 2020 at 03:33:23PM +0200, Baruch Siach wrote: > >> When mvebu_pwm_probe() fails IRQ domain is not released. Move > >> mvebu_pwm_probe() before IRQ domain registration. > > > > And now if something with IRQ domain registration fails the pwm stuff > > isn't freed? > > As far as I can see mvebu_pwm_probe() uses devres exclusively to > allocate resources. there is no devm magic in pwmchip_add(). Best regards Uwe
diff --git a/drivers/gpio/gpio-mvebu.c b/drivers/gpio/gpio-mvebu.c index 433e2c3f3fd5..4a331c8f6b06 100644 --- a/drivers/gpio/gpio-mvebu.c +++ b/drivers/gpio/gpio-mvebu.c @@ -1197,6 +1197,13 @@ static int mvebu_gpio_probe(struct platform_device *pdev) devm_gpiochip_add_data(&pdev->dev, &mvchip->chip, mvchip); + /* Some MVEBU SoCs have simple PWM support for GPIO lines */ + if (IS_ENABLED(CONFIG_PWM)) { + err = mvebu_pwm_probe(pdev, mvchip, id); + if (err) + return err; + } + /* Some gpio controllers do not provide irq support */ if (!have_irqs) return 0; @@ -1254,10 +1261,6 @@ static int mvebu_gpio_probe(struct platform_device *pdev) mvchip); } - /* Some MVEBU SoCs have simple PWM support for GPIO lines */ - if (IS_ENABLED(CONFIG_PWM)) - return mvebu_pwm_probe(pdev, mvchip, id); - return 0; err_domain:
When mvebu_pwm_probe() fails IRQ domain is not released. Move mvebu_pwm_probe() before IRQ domain registration. Fixes: 757642f9a584 ("gpio: mvebu: Add limited PWM support") Reported-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: Baruch Siach <baruch@tkos.co.il> --- This is split out of the "gpio: mvebu: Armada 8K/7K PWM support" series. I'll rebase the series v2 on top on this fix. --- drivers/gpio/gpio-mvebu.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)