[lvc-project] Fwd: [PATCH] pinctrl: rockchip: fix NULL ptr deref in rockchip_pinctrl_parse_groups()

[Fedor Pchelkin]

On Thu, 16. Oct 19:40, Sergey Shtylyov wrote:
> Вот - забыл lvc-project в CC добавить...
> Мэйнтейнер сказал, что смёржил патч, но я нигде его не вижу:
> 
> https://lore.kernel.org/all/CACRpkdbzEmZN=-FPvax4z_iq7u6pHyHGJ213QtpxqFL98-Ou5Q@mail.gmail.com/
> 

Просьба направить отдельную версию (версии) для 5.10, 6.1 и 6.12 веток.
Апстримный патч туда не применяется.

Также в будущем лучше в похожих ситуациях обходиться без форвардинга
сообщения, git-am такие письма плохо прожёвывает, а отправлять обычный патч
чисто в список рассылки lvc-patches at linuxtesting.org.

> -------- Forwarded Message --------
> Subject: [PATCH] pinctrl: rockchip: fix NULL ptr deref in rockchip_pinctrl_parse_groups()
> Date: Wed, 3 Sep 2025 22:48:54 +0300
> From: Sergey Shtylyov <s.shtylyov at omp.ru>
> Organization: Open Mobile Platform
> To: Linus Walleij <linus.walleij at linaro.org>, Heiko Stuebner <heiko at sntech.de>, linux-gpio at vger.kernel.org
> CC: linux-arm-kernel at lists.infradead.org, linux-rockchip at lists.infradead.org
> 
> In the Rockchip driver, rockchip_pinctrl_parse_groups() assumes that the
> "rockchip,pins" property will always be present in the DT node it parses
> and so doesn't check the result of of_get_property() for NULL. If the DT
> passed to the kernel happens to have such property missing, then we will
> get a kernel oops when the pointer is dereferenced in the *for* loop just
> a few lines after the call.  I think it's better to play safe by checking
> the list variable for NULL (and reporting error if so), like we check the
> size variable for validity further down...
> 
> Found by Linux Verification Center (linuxtesting.org) with the Svace static
> analysis tool.
> 
> Fixes: d3e5116119bd ("pinctrl: add pinctrl driver for Rockchip SoCs")
> Signed-off-by: Sergey Shtylyov <s.shtylyov at omp.ru>
> 
> ---
> The patch is against the master branch of Linus Torvalds' linux.git repo.
> 
>  drivers/pinctrl/pinctrl-rockchip.c |    4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> Index: linux/drivers/pinctrl/pinctrl-rockchip.c
> ===================================================================
> --- linux.orig/drivers/pinctrl/pinctrl-rockchip.c
> +++ linux/drivers/pinctrl/pinctrl-rockchip.c
> @@ -3488,7 +3488,9 @@ static int rockchip_pinctrl_parse_groups
>  	 * do sanity check and calculate pins number
>  	 */
>  	list = of_get_property(np, "rockchip,pins", &size);
> -	/* we do not check return since it's safe node passed down */
> +	if (!list)
> +		return dev_err_probe(dev, -EINVAL,
> +				     "%pOF: no rockchip,pins property\n", np);
>  	size /= sizeof(*list);
>  	if (!size || size % 4)
>  		return dev_err_probe(dev, -EINVAL,
> 
> _______________________________________________
> lvc-project mailing list
> lvc-project at linuxtesting.org
> http://linuxtesting.org/cgi-bin/mailman/listinfo/lvc-project