Patch "gpio: make sure gpiod_to_irq() returns negative on NULL desc" has been added to the 4.6-stable tree

[<gregkh@linuxfoundation.org>]

This is a note to let you know that I've just added the patch titled

    gpio: make sure gpiod_to_irq() returns negative on NULL desc

to the 4.6-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     gpio-make-sure-gpiod_to_irq-returns-negative-on-null-desc.patch
and it can be found in the queue-4.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.


>From 79bb71bd1d93197ce227fa167b450b633f30a52b Mon Sep 17 00:00:00 2001
From: Linus Walleij <linus.walleij@linaro.org>
Date: Wed, 15 Jun 2016 22:57:38 +0200
Subject: gpio: make sure gpiod_to_irq() returns negative on NULL desc

From: Linus Walleij <linus.walleij@linaro.org>

commit 79bb71bd1d93197ce227fa167b450b633f30a52b upstream.

commit 54d77198fdfbc4f0fe11b4252c1d9c97d51a3264
("gpio: bail out silently on NULL descriptors")
doesn't work for gpiod_to_irq(): drivers assume that NULL
descriptors will give negative IRQ numbers in return.

It has been pointed out that returning 0 is NO_IRQ and that
drivers should be amended to treat this as an error, but that
is for the longer term: now let us repair the semantics.

Cc: Maxime Ripard <maxime.ripard@free-electrons.com>
Reported-by: Hans de Goede <hdegoede@redhat.com>
Tested-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpio/gpiolib.c |    9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -2006,7 +2006,14 @@ int gpiod_to_irq(const struct gpio_desc
 	struct gpio_chip	*chip;
 	int			offset;
 
-	VALIDATE_DESC(desc);
+	/*
+	 * Cannot VALIDATE_DESC() here as gpiod_to_irq() consumer semantics
+	 * requires this function to not return zero on an invalid descriptor
+	 * but rather a negative error number.
+	 */
+	if (!desc || !desc->gdev || !desc->gdev->chip)
+		return -EINVAL;
+
 	chip = desc->gdev->chip;
 	offset = gpio_chip_hwgpio(desc);
 	return chip->to_irq ? chip->to_irq(chip, offset) : -ENXIO;


Patches currently in stable-queue which might be from linus.walleij@linaro.org are

queue-4.6/gpiolib-fix-unaligned-used-of-reference-counters.patch
queue-4.6/gpio-zynq-fix-the-error-path.patch
queue-4.6/gpio-bcm-kona-fix-bcm_kona_gpio_reset-warnings.patch
queue-4.6/pinctrl-mediatek-fix-dual-edge-code-defect.patch
queue-4.6/gpio-bail-out-silently-on-null-descriptors.patch
queue-4.6/gpio-zynq-initialize-clock-even-without-config_pm.patch
queue-4.6/gpio-make-sure-gpiod_to_irq-returns-negative-on-null-desc.patch
queue-4.6/gpiolib-fix-null-pointer-deference.patch