diff options
| author | Bartosz Golaszewski <bartosz.golaszewski@linaro.org> | 2025-02-10 11:52:01 +0100 |
|---|---|---|
| committer | Bartosz Golaszewski <bartosz.golaszewski@linaro.org> | 2025-02-24 10:02:36 +0100 |
| commit | 4750ddce95ae8be618e31b0aa51efcf50e23a78e (patch) | |
| tree | af318ac5608e1fce98702ebb0839febb71c8d99f /drivers/gpio/gpiolib.c | |
| parent | dfeb70c86d637d49af9313245e6b1f2ead08ce9b (diff) | |
gpiolib: sanitize the return value of gpio_chip::direction_input()
The return value of the direction_input() callback may be propagated to
user-space. As per the API contract it can only return 0 or a negative
error number. Add a wrapper around the callback calls that filters out
anything else.
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Link: https://lore.kernel.org/r/20250210-gpio-sanitize-retvals-v1-7-12ea88506cb2@linaro.org
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Diffstat (limited to 'drivers/gpio/gpiolib.c')
| -rw-r--r-- | drivers/gpio/gpiolib.c | 24 |
1 files changed, 20 insertions, 4 deletions
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c index 2c8c4183f6f0..e720a1d2f343 100644 --- a/drivers/gpio/gpiolib.c +++ b/drivers/gpio/gpiolib.c @@ -2701,6 +2701,22 @@ int gpio_set_debounce_timeout(struct gpio_desc *desc, unsigned int debounce) return ret; } +static int gpiochip_direction_input(struct gpio_chip *gc, unsigned int offset) +{ + int ret; + + lockdep_assert_held(&gc->gpiodev->srcu); + + if (WARN_ON(!gc->direction_input)) + return -EOPNOTSUPP; + + ret = gc->direction_input(gc, offset); + if (ret > 0) + ret = -EBADE; + + return ret; +} + static int gpiochip_direction_output(struct gpio_chip *gc, unsigned int offset, int value) { @@ -2769,8 +2785,8 @@ int gpiod_direction_input_nonotify(struct gpio_desc *desc) * assume we are in input mode after this. */ if (guard.gc->direction_input) { - ret = guard.gc->direction_input(guard.gc, - gpio_chip_hwgpio(desc)); + ret = gpiochip_direction_input(guard.gc, + gpio_chip_hwgpio(desc)); } else if (guard.gc->get_direction) { ret = guard.gc->get_direction(guard.gc, gpio_chip_hwgpio(desc)); @@ -3475,7 +3491,7 @@ static void gpio_set_open_drain_value_commit(struct gpio_desc *desc, bool value) return; if (value) { - ret = guard.gc->direction_input(guard.gc, offset); + ret = gpiochip_direction_input(guard.gc, offset); } else { ret = gpiochip_direction_output(guard.gc, offset, 0); if (!ret) @@ -3506,7 +3522,7 @@ static void gpio_set_open_source_value_commit(struct gpio_desc *desc, bool value if (!ret) set_bit(FLAG_IS_OUT, &desc->flags); } else { - ret = guard.gc->direction_input(guard.gc, offset); + ret = gpiochip_direction_input(guard.gc, offset); } trace_gpio_direction(desc_to_gpio(desc), !value, ret); if (ret < 0) |