lkml.org 
[lkml]   [2018]   [May]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.16 24/72] gpioib: do not free unrequested descriptors
    Date
    4.16-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Timur Tabi <timur@codeaurora.org>

    commit ab3dbcf78f60f46d6a0ad63b1f4b690b7a427140 upstream.

    If the main loop in linehandle_create() encounters an error, it
    unwinds completely by freeing all previously requested GPIO
    descriptors. However, if the error occurs in the beginning of
    the loop before that GPIO is requested, then the exit code
    attempts to free a null descriptor. If extrachecks is enabled,
    gpiod_free() triggers a WARN_ON.

    Instead, keep a separate count of legitimate GPIOs so that only
    those are freed.

    Cc: stable@vger.kernel.org
    Fixes: d7c51b47ac11 ("gpio: userspace ABI for reading/writing GPIO lines")
    Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
    Signed-off-by: Timur Tabi <timur@codeaurora.org>
    Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/gpio/gpiolib.c | 5 +++--
    1 file changed, 3 insertions(+), 2 deletions(-)

    --- a/drivers/gpio/gpiolib.c
    +++ b/drivers/gpio/gpiolib.c
    @@ -446,7 +446,7 @@ static int linehandle_create(struct gpio
    struct gpiohandle_request handlereq;
    struct linehandle_state *lh;
    struct file *file;
    - int fd, i, ret;
    + int fd, i, count = 0, ret;
    u32 lflags;

    if (copy_from_user(&handlereq, ip, sizeof(handlereq)))
    @@ -507,6 +507,7 @@ static int linehandle_create(struct gpio
    if (ret)
    goto out_free_descs;
    lh->descs[i] = desc;
    + count = i;

    if (lflags & GPIOHANDLE_REQUEST_ACTIVE_LOW)
    set_bit(FLAG_ACTIVE_LOW, &desc->flags);
    @@ -577,7 +578,7 @@ static int linehandle_create(struct gpio
    out_put_unused_fd:
    put_unused_fd(fd);
    out_free_descs:
    - for (; i >= 0; i--)
    + for (i = 0; i < count; i++)
    gpiod_free(lh->descs[i]);
    kfree(lh->label);
    out_free_lh:

    \
     
     \ /
      Last update: 2018-05-14 09:10    [W:4.437 / U:0.116 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site