Messages in this thread | | | Date | Sat, 30 Nov 2013 09:21:48 -0800 | From | Tony Lindgren <> | Subject | Re: [PATCH 3/3] pinctrl: single: fix infinite loop caused by bad mask |
| |
* Tomi Valkeinen <tomi.valkeinen@ti.com> [131128 03:30]: > If the masks in DT data are not quite right, > pcs_parse_bits_in_pinctrl_entry() can end up in an infinite loop, > trashing memory at the same time. > > Add a check to verify that each loop actually removes bits from the > 'mask', so that the loop can eventually end.
Linus W, might be worth updating the change log with the regression causing commit. Something like commit 4e7e8017a80e1 (pinctrl: pinctrl-single: enhance to configure multiple pins of different modules) improved support for pinctrl-single,bits option, but also caused a regression in parsing badly configured mask data.
Acked-by: Tony Lindgren <tony@atomide.com>
> Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com> > --- > drivers/pinctrl/pinctrl-single.c | 8 ++++++++ > 1 file changed, 8 insertions(+) > > diff --git a/drivers/pinctrl/pinctrl-single.c b/drivers/pinctrl/pinctrl-single.c > index 174f4c50cd77..de6459628b4f 100644 > --- a/drivers/pinctrl/pinctrl-single.c > +++ b/drivers/pinctrl/pinctrl-single.c > @@ -1318,6 +1318,14 @@ static int pcs_parse_bits_in_pinctrl_entry(struct pcs_device *pcs, > mask_pos = ((pcs->fmask) << (bit_pos - 1)); > val_pos = val & mask_pos; > submask = mask & mask_pos; > + > + if ((mask & mask_pos) == 0) { > + dev_err(pcs->dev, > + "Invalid mask for %s at 0x%x\n", > + np->name, offset); > + break; > + } > + > mask &= ~mask_pos; > > if (submask != mask_pos) { > -- > 1.8.3.2 >
| |