Skip to content

Commit 95ae997

Browse files
warthog618Bartosz Golaszewski
authored andcommitted
gpio: sim: fix memory corruption when adding named lines and unnamed hogs
When constructing the sim, gpio-sim constructs an array of named lines, sized based on the largest offset of any named line, and then initializes that array with the names of all lines, including unnamed hogs with higher offsets. In doing so it writes NULLs beyond the extent of the array. Add a check that only named lines are used to initialize the array. Fixes: cb8c474 ("gpio: sim: new testing module") Signed-off-by: Kent Gibson<[email protected]> Signed-off-by: Bartosz Golaszewski <[email protected]>
1 parent 9561de3 commit 95ae997

File tree

1 file changed

+4
-2
lines changed

1 file changed

+4
-2
lines changed

drivers/gpio/gpio-sim.c

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -721,8 +721,10 @@ static char **gpio_sim_make_line_names(struct gpio_sim_bank *bank,
721721
if (!line_names)
722722
return ERR_PTR(-ENOMEM);
723723

724-
list_for_each_entry(line, &bank->line_list, siblings)
725-
line_names[line->offset] = line->name;
724+
list_for_each_entry(line, &bank->line_list, siblings) {
725+
if (line->name && (line->offset <= max_offset))
726+
line_names[line->offset] = line->name;
727+
}
726728

727729
return line_names;
728730
}

0 commit comments

Comments
 (0)