On Sat, Jul 29, 2017 at 11:00 AM, Masami Hiramatsu <mhiramat@xxxxxxxxxx> wrote: > Check user-given gpio number and reject it before > calling gpio_to_desc() because gpio_to_desc() is > for kernel driver and it expects given gpio number > is valid (means 0 to 511). > If given number is invalid, gpio_to_desc() calls > WARN() and dump registers and stack for debug. > This means user can easily kick WARN() just by > writing invalid gpio number (e.g. 512) to > /sys/class/gpio/export. > This bug has been introduced by commit 0e9a5edf5d01 > ("gpio: fix deferred probe detection for legacy API") Why so narrow paraghraps? We don't do two column articles :-) > Signed-off-by: Masami Hiramatsu <mhiramat@xxxxxxxxxx> > Fixes: commit 0e9a5edf5d01 ("gpio: fix deferred probe detection for legacy API") If you use git tools directly, like % git commit -s --amend you will immediately notice that your SoB line is supposed to be the last one. Besides above, word "commit" is not needed in Fixes: tag IIRC. > --- a/drivers/gpio/gpiolib-sysfs.c > +++ b/drivers/gpio/gpiolib-sysfs.c > @@ -2,6 +2,7 @@ > #include <linux/mutex.h> > #include <linux/device.h> > #include <linux/sysfs.h> > +#include <linux/gpio.h> > #include <linux/gpio/consumer.h> > #include <linux/gpio/driver.h> > #include <linux/interrupt.h> > @@ -443,14 +444,16 @@ static ssize_t export_store(struct class *class, > - struct gpio_desc *desc; > + struct gpio_desc *desc = NULL; > - desc = gpio_to_desc(gpio); > + if (gpio_is_valid(gpio)) > + desc = gpio_to_desc(gpio); Twice repeatition is a candidate for a helper, like: static inline struct gpio_desc *gpio_to_valid_desc(int gpio) { return gpio_is_valid(gpio) ? gpio_to_desc(gpio) : NULL; } -- With Best Regards, Andy Shevchenko -- To unsubscribe from this list: send the line "unsubscribe linux-gpio" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html