From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 45649134A4 for ; Mon, 12 Jun 2023 10:51:12 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 98F69C433D2; Mon, 12 Jun 2023 10:51:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1686567072; bh=ogko3ICwlsBQskfHN4CzWsk/V5Hg42/emqb+vSKNaSk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=VghiD4JrY1vkXCgg7y5guE220gUpE6wc+CPNUY6s6p7pSK8d++2fiQQAQwliHT7hY 5dOjGFC69dAOC+WdSyd+tEwXVMltc5d7p7U31ng1rsCOKmKrRZrV+WIu8sIJjpK9cd sMHfd9Xnl57ciOqsr7rYTa/fiXwQk/+ILzbDHgPA= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Kent Gibson , Bartosz Golaszewski , Sasha Levin Subject: [PATCH 6.3 139/160] gpio: sim: fix memory corruption when adding named lines and unnamed hogs Date: Mon, 12 Jun 2023 12:27:51 +0200 Message-ID: <20230612101721.426579718@linuxfoundation.org> X-Mailer: git-send-email 2.41.0 In-Reply-To: <20230612101715.129581706@linuxfoundation.org> References: <20230612101715.129581706@linuxfoundation.org> User-Agent: quilt/0.67 Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit From: Kent Gibson [ Upstream commit 95ae9979bfe3174c2ee8d64409c44532f2881907 ] When constructing the sim, gpio-sim constructs an array of named lines, sized based on the largest offset of any named line, and then initializes that array with the names of all lines, including unnamed hogs with higher offsets. In doing so it writes NULLs beyond the extent of the array. Add a check that only named lines are used to initialize the array. Fixes: cb8c474e79be ("gpio: sim: new testing module") Signed-off-by: Kent Gibson Signed-off-by: Bartosz Golaszewski Signed-off-by: Sasha Levin --- drivers/gpio/gpio-sim.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/gpio/gpio-sim.c b/drivers/gpio/gpio-sim.c index e5dfd636c63c1..09aa0b64859b4 100644 --- a/drivers/gpio/gpio-sim.c +++ b/drivers/gpio/gpio-sim.c @@ -721,8 +721,10 @@ static char **gpio_sim_make_line_names(struct gpio_sim_bank *bank, if (!line_names) return ERR_PTR(-ENOMEM); - list_for_each_entry(line, &bank->line_list, siblings) - line_names[line->offset] = line->name; + list_for_each_entry(line, &bank->line_list, siblings) { + if (line->name && (line->offset <= max_offset)) + line_names[line->offset] = line->name; + } return line_names; } -- 2.39.2