| Message ID | 20241003023307.2138695-1-clf700383@gmail.com |
|---|---|
| State | New |
| Headers | show |
| Series | pinctrl: fix Null pointer dereference | expand |
On Thu, Oct 03, 2024 at 10:33:07AM +0800, clingfei wrote: > pinmux_generic_get_function may returns NULL, and its retval is > dereferenced without check, which will cause a null pointer dereference. > > Signed-off-by: clingfei <clf700383@gmail.com> > --- > drivers/pinctrl/pinctrl-th1520.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/drivers/pinctrl/pinctrl-th1520.c b/drivers/pinctrl/pinctrl-th1520.c > index 1bb78b212fd5..9331f4462480 100644 > --- a/drivers/pinctrl/pinctrl-th1520.c > +++ b/drivers/pinctrl/pinctrl-th1520.c > @@ -798,6 +798,8 @@ static int th1520_pinmux_set_mux(struct pinctrl_dev *pctldev, > struct th1520_pinctrl *thp = pinctrl_dev_get_drvdata(pctldev); > const struct function_desc *func = pinmux_generic_get_function(pctldev, fsel); > > + if (!func) > + return -EINVAL; > return th1520_pinmux_set(thp, thp->desc.pins[gsel].number, > (uintptr_t)thp->desc.pins[gsel].drv_data & TH1520_PAD_MUXDATA, > (uintptr_t)func->data); > -- > 2.34.1 Thanks for fixing the formating in the previous attempt. As Kees Bakker noted [1], I failed to have this check in my v3 patch series. This fix makes pinctrl-th1520 behave the same as other drivers that call pinmux_generic_get_function() like pinctrl-single. I have applied your patch and the driver still works as expected on my LPi4a. Hopefully Linus can apply this fix on top of my v3 series. Reviewed-by: Drew Fustini <dfustini@tenstorrent.com> -Drew [1] https://lore.kernel.org/lkml/87770518-5f63-4adf-b6ea-c7f92b58ce22@ijzerbout.nl/
On Thu, Oct 3, 2024 at 4:33 AM clingfei <clf700383@gmail.com> wrote: > pinmux_generic_get_function may returns NULL, and its retval is > dereferenced without check, which will cause a null pointer dereference. > > Signed-off-by: clingfei <clf700383@gmail.com> Fixed up topic, added Drew's tag and applied, thanks! Yours, Linus Walleij
diff --git a/drivers/pinctrl/pinctrl-th1520.c b/drivers/pinctrl/pinctrl-th1520.c index 1bb78b212fd5..9331f4462480 100644 --- a/drivers/pinctrl/pinctrl-th1520.c +++ b/drivers/pinctrl/pinctrl-th1520.c @@ -798,6 +798,8 @@ static int th1520_pinmux_set_mux(struct pinctrl_dev *pctldev, struct th1520_pinctrl *thp = pinctrl_dev_get_drvdata(pctldev); const struct function_desc *func = pinmux_generic_get_function(pctldev, fsel); + if (!func) + return -EINVAL; return th1520_pinmux_set(thp, thp->desc.pins[gsel].number, (uintptr_t)thp->desc.pins[gsel].drv_data & TH1520_PAD_MUXDATA, (uintptr_t)func->data);
pinmux_generic_get_function may returns NULL, and its retval is dereferenced without check, which will cause a null pointer dereference. Signed-off-by: clingfei <clf700383@gmail.com> --- drivers/pinctrl/pinctrl-th1520.c | 2 ++ 1 file changed, 2 insertions(+)