Commit 95ae9979 authored Jun 06, 2023 by Kent Gibson Committed by Bartosz Golaszewski Jun 06, 2023

gpio: sim: fix memory corruption when adding named lines and unnamed hogs

When constructing the sim, gpio-sim constructs an array of named lines,
sized based on the largest offset of any named line, and then initializes
that array with the names of all lines, including unnamed hogs with higher
offsets. In doing so it writes NULLs beyond the extent of the array.

Add a check that only named lines are used to initialize the array.

Fixes: cb8c474e ("gpio: sim: new testing module")
Signed-off-by: Kent <Gibson<warthog618@gmail.com>
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>

parent 9561de3a

drivers/gpio/gpio-sim.c

+4 −2

Original line number	Diff line number	Diff line
		@@ -721,8 +721,10 @@ static char *gpio_sim_make_line_names(struct gpio_sim_bank bank,
		if (!line_names)
		return ERR_PTR(-ENOMEM);

		list_for_each_entry(line, &bank->line_list, siblings)
		list_for_each_entry(line, &bank->line_list, siblings) {
		if (line->name && (line->offset <= max_offset))
		line_names[line->offset] = line->name;
		}

		return line_names;
		}