[Home]

Issue of the Implementation # L0349

Brief

gpio: ml-ioh: buffer underwrite on probe error path

Detailed Description

If ioh_gpio_probe() fails on devm_irq_alloc_descs() then chip may point to any element of chip_save array, so reverse iteration from pointer chip may become chip_save[-1] and gpiochip_remove() will operate with wrong memory.

Component

linux-kernel 4.18

Accepted

https://lkml.org/lkml/2018/7/23/949
commit

Status

Fixed in kernel v4.19-rc1

[Home]