Messages in this thread Patch in this message | | | From | Tomi Valkeinen <> | Subject | [PATCH 3/3] pinctrl: single: fix infinite loop caused by bad mask | Date | Thu, 28 Nov 2013 13:29:20 +0200 |
| |
If the masks in DT data are not quite right, pcs_parse_bits_in_pinctrl_entry() can end up in an infinite loop, trashing memory at the same time.
Add a check to verify that each loop actually removes bits from the 'mask', so that the loop can eventually end.
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com> --- drivers/pinctrl/pinctrl-single.c | 8 ++++++++ 1 file changed, 8 insertions(+)
diff --git a/drivers/pinctrl/pinctrl-single.c b/drivers/pinctrl/pinctrl-single.c index 174f4c50cd77..de6459628b4f 100644 --- a/drivers/pinctrl/pinctrl-single.c +++ b/drivers/pinctrl/pinctrl-single.c @@ -1318,6 +1318,14 @@ static int pcs_parse_bits_in_pinctrl_entry(struct pcs_device *pcs, mask_pos = ((pcs->fmask) << (bit_pos - 1)); val_pos = val & mask_pos; submask = mask & mask_pos; + + if ((mask & mask_pos) == 0) { + dev_err(pcs->dev, + "Invalid mask for %s at 0x%x\n", + np->name, offset); + break; + } + mask &= ~mask_pos; if (submask != mask_pos) { -- 1.8.3.2
| |