linux-kernel - [PATCH] gpio: swnode: Don't use __free() on result of swnode_get_gpio

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Mon, 4 Mar 2024 16:03:20 +0000
From: Charles Keepax <ckeepax@...nsource.cirrus.com>
To: <linus.walleij@...aro.org>, <brgl@...ev.pl>
CC: <linux-gpio@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
        <patches@...nsource.cirrus.com>
Subject: [PATCH] gpio: swnode: Don't use __free() on result of swnode_get_gpio_device()

swnode_get_gpio_device() can return an error pointer, however
gpio_device_put() is not able to accept error values. Thus using
__free() will result in dereferencing an invalid pointer.

As there is only a single exit point anyway, simply call
gpio_device_put() manually. Whilst modifying the code move
the variable declaration to the top of the function, and move
fwnode_handle_put() until after the error check. Technically
fwnode_handle_put() will handle being passed an error value, but
no need to call it when the code knows it doesn't need to.

Fixes: b7b56e64a345 ("gpio: swnode: replace gpiochip_find() with gpio_device_find_by_label()")
Signed-off-by: Charles Keepax <ckeepax@...nsource.cirrus.com>
---
 drivers/gpio/gpiolib-swnode.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/gpio/gpiolib-swnode.c b/drivers/gpio/gpiolib-swnode.c
index fa52bdb1a29a3..de43e0b06a4b1 100644
--- a/drivers/gpio/gpiolib-swnode.c
+++ b/drivers/gpio/gpiolib-swnode.c
@@ -50,6 +50,7 @@ struct gpio_desc *swnode_find_gpio(struct fwnode_handle *fwnode,
 {
 	const struct software_node *swnode;
 	struct fwnode_reference_args args;
+	struct gpio_device *gdev;
 	struct gpio_desc *desc;
 	char propname[32]; /* 32 is max size of property name */
 	int error;
@@ -71,12 +72,12 @@ struct gpio_desc *swnode_find_gpio(struct fwnode_handle *fwnode,
 		return ERR_PTR(error);
 	}
 
-	struct gpio_device *gdev __free(gpio_device_put) =
-					swnode_get_gpio_device(args.fwnode);
-	fwnode_handle_put(args.fwnode);
+	gdev = swnode_get_gpio_device(args.fwnode);
 	if (IS_ERR(gdev))
 		return ERR_CAST(gdev);
 
+	fwnode_handle_put(args.fwnode);
+
 	/*
 	 * FIXME: The GPIO device reference is put at return but the descriptor
 	 * is passed on. Find a proper solution.
@@ -87,6 +88,8 @@ struct gpio_desc *swnode_find_gpio(struct fwnode_handle *fwnode,
 	pr_debug("%s: parsed '%s' property of node '%pfwP[%d]' - status (%d)\n",
 		 __func__, propname, fwnode, idx, PTR_ERR_OR_ZERO(desc));
 
+	gpio_device_put(gdev);
+
 	return desc;
 }
 
-- 
2.39.2