[lkml]   [2017]   [Nov]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [PATCH] gpio: 74x164: Fix crash during .remove()
On Tue, Nov 21, 2017 at 3:18 PM, Geert Uytterhoeven
<> wrote:

> Commit 7ebc194d0fd4bb0f ("gpio: 74x164: Introduce 'enable-gpios'
> property") added a new member gpiod_oe to the end of the struct
> gen_74x164_chip, after the zero-length buffer array.
> However, this buffer is a flexible array, allocated together with the
> structure during .probe(). As the buffer is no longer the last member,
> writing to it corrupts the newly added member after it.
> During device removal, the corrupted member will be used as a pointer,
> leading to a crash.
> This went unnoticed, as the flexible array was declared as "buffer[0]"
> instead of "buffer[]", and thus did not trigger a "flexible array member
> not at end of struct" error from gcc.
> Move the gpiod_oe field up to fix this, and drop the zero from the array
> size to prevent future similar bugs.
> Fixes: 7ebc194d0fd4bb0f ("gpio: 74x164: Introduce 'enable-gpios' property")
> Signed-off-by: Geert Uytterhoeven <>

Patch applied for fixes with Fabio's ACK.

Linus Walleij

 \ /
  Last update: 2017-11-30 15:32    [W:0.043 / U:0.940 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site