Commit c4aea1aa authored by Andy Shevchenko's avatar Andy Shevchenko Committed by Yifan Qiao
Browse files

gpiolib: Fix crash on error in gpiochip_get_ngpios() 

mainline inclusion
from mainline-v6.14-rc3
commit 7b4aebeecbbd5b5fe73e35fad3f62ed21aa7ef44
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/IBPULH
CVE: CVE-2025-21783

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7b4aebeecbbd5b5fe73e35fad3f62ed21aa7ef44



--------------------------------

The gpiochip_get_ngpios() uses chip_*() macros to print messages.
However these macros rely on gpiodev to be initialised and set,
which is not the case when called via bgpio_init(). In such a case
the printing messages will crash on NULL pointer dereference.
Replace chip_*() macros by the respective dev_*() ones to avoid
such crash.

Fixes: 55b2395e ("gpio: mmio: handle "ngpios" properly in bgpio_init()")
Signed-off-by: default avatarAndy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://lore.kernel.org/r/20250213155646.2882324-1-andriy.shevchenko@linux.intel.com


Signed-off-by: default avatarBartosz Golaszewski <bartosz.golaszewski@linaro.org>
Signed-off-by: default avatarYifan Qiao <qiaoyifan4@huawei.com>
parent 9d22d5b7

drivers/gpio/gpiolib.c

+3 −3
Original line number Diff line number Diff line
@@ -723,12 +723,12 @@ int gpiochip_get_ngpios(struct gpio_chip *gc, struct device *dev) 
	}



	if (gc->ngpio == 0) {

		chip_err(gc, "tried to insert a GPIO chip with zero lines\n");

		dev_err(dev, "tried to insert a GPIO chip with zero lines\n");

		return -EINVAL;

	}



	if (gc->ngpio > FASTPATH_NGPIO)

		chip_warn(gc, "line cnt %u is greater than fast path cnt %u\n",

		dev_warn(dev, "line cnt %u is greater than fast path cnt %u\n",

			 gc->ngpio, FASTPATH_NGPIO);



	return 0;