Commit b1ca3d75 authored by Zeng Heng's avatar Zeng Heng
Browse files

pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map() 

mainline inclusion
from mainline-v6.9-rc7
commit a0cedbcc8852d6c77b00634b81e41f17f29d9404
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9U3W9
CVE: CVE-2024-36959

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a0cedbcc8852d6c77b00634b81e41f17f29d9404



----------------------------------------------------

If we fail to allocate propname buffer, we need to drop the reference
count we just took. Because the pinctrl_dt_free_maps() includes the
droping operation, here we call it directly.

Fixes: 91d5c506 ("pinctrl: devicetree: fix null pointer dereferencing in pinctrl_dt_to_map")
Suggested-by: default avatarDan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: default avatarZeng Heng <zengheng4@huawei.com>
Reviewed-by: default avatarDan Carpenter <dan.carpenter@linaro.org>
Message-ID: <20240415105328.3651441-1-zengheng4@huawei.com>
Signed-off-by: default avatarLinus Walleij <linus.walleij@linaro.org>
parent d8a3bc61

drivers/pinctrl/devicetree.c

+6 −4
Original line number Diff line number Diff line
@@ -220,14 +220,16 @@ int pinctrl_dt_to_map(struct pinctrl *p, struct pinctrl_dev *pctldev) 
	for (state = 0; ; state++) {

		/* Retrieve the pinctrl-* property */

		propname = kasprintf(GFP_KERNEL, "pinctrl-%d", state);

		if (!propname)

			return -ENOMEM;

		if (!propname) {

			ret = -ENOMEM;

			goto err;

		}

		prop = of_find_property(np, propname, &size);

		kfree(propname);

		if (!prop) {

			if (state == 0) {

				of_node_put(np);

				return -ENODEV;

				ret = -ENODEV;

				goto err;

			}

			break;

		}