All of lore.kernel.org
 help / color / mirror / Atom feed
From: Hans de Goede <hansg@kernel.org>
To: Mika Westerberg <westeri@kernel.org>,
	Andy Shevchenko <andy@kernel.org>,
	Bartosz Golaszewski <brgl@bgdev.pl>,
	Linus Walleij <linus.walleij@linaro.org>
Cc: Hans de Goede <hansg@kernel.org>,
	linux-gpio@vger.kernel.org, linux-acpi@vger.kernel.org
Subject: [6.17 REGRESSION FIX] gpiolib: acpi: Fix using random stack memory during GPIO lookups
Date: Sat, 13 Sep 2025 00:18:59 +0200	[thread overview]
Message-ID: <20250912221859.368173-1-hansg@kernel.org> (raw)

Before commit 8b4f52ef7a41 ("gpiolib: acpi: Deduplicate some code in
__acpi_find_gpio()") and the follow-up fix commit 7c010d463372 ("gpiolib:
acpi: Make sure we fill struct acpi_gpio_info"). The struct acpi_gpio_info
used during lookups was part of struct acpi_gpio_lookup which gets
memset() to 0 before use.

And then after a successful lookup, acpi_gpio_resource_lookup() would
copy the content of the zeroed acpi_gpio_lookup.info to the on
stack struct acpi_gpio_info in __acpi_find_gpio(), overwriting any
uninitialized memory contents there.

But now instead a pointer to the on stack struct acpi_gpio_info in
__acpi_find_gpio() is passed around, but that struct is never
initialized.

This passing around of the uninitialized struct breaks index based
lookups of GpioInt GPIOs because info->quirks now contains some random
on stack data which may contain ACPI_GPIO_QUIRK_ONLY_GPIOIO.

Initialize the on stack struct acpi_gpio_info to 0 to fix this.

Fixes: 8b4f52ef7a41 ("gpiolib: acpi: Deduplicate some code in __acpi_find_gpio()")
Fixes: 7c010d463372 ("gpiolib: acpi: Make sure we fill struct acpi_gpio_info")
Signed-off-by: Hans de Goede <hansg@kernel.org>
---
 drivers/gpio/gpiolib-acpi-core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpio/gpiolib-acpi-core.c b/drivers/gpio/gpiolib-acpi-core.c
index 12b24a717e43..1cc5d0702ee1 100644
--- a/drivers/gpio/gpiolib-acpi-core.c
+++ b/drivers/gpio/gpiolib-acpi-core.c
@@ -942,7 +942,7 @@ struct gpio_desc *acpi_find_gpio(struct fwnode_handle *fwnode,
 {
 	struct acpi_device *adev = to_acpi_device_node(fwnode);
 	bool can_fallback = acpi_can_fallback_to_crs(adev, con_id);
-	struct acpi_gpio_info info;
+	struct acpi_gpio_info info = { };
 	struct gpio_desc *desc;
 
 	desc = __acpi_find_gpio(fwnode, con_id, idx, can_fallback, &info);
-- 
2.51.0


             reply	other threads:[~2025-09-12 22:19 UTC|newest]

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2025-09-12 22:18 Hans de Goede [this message]
2025-09-14 13:24 ` [6.17 REGRESSION FIX] gpiolib: acpi: Fix using random stack memory during GPIO lookups Andy Shevchenko
2025-09-14 17:52   ` Hans de Goede
2025-09-15  6:28     ` Andy Shevchenko

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20250912221859.368173-1-hansg@kernel.org \
    --to=hansg@kernel.org \
    --cc=andy@kernel.org \
    --cc=brgl@bgdev.pl \
    --cc=linus.walleij@linaro.org \
    --cc=linux-acpi@vger.kernel.org \
    --cc=linux-gpio@vger.kernel.org \
    --cc=westeri@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.