Re: [PATCH v1 2/2] gpiolib: of: Integrate of_gpiochip_init_valid_mask() into gpiochip_init_valid_mask()

[Andy Shevchenko <andriy.shevchenko@xxxxxxxxxxxxxxx>]

On Mon, Nov 07, 2022 at 01:40:53PM -0800, Dmitry Torokhov wrote:
> On Mon, Nov 07, 2022 at 11:09:19PM +0200, Andy Shevchenko wrote:
> > On Mon, Nov 07, 2022 at 10:20:37AM -0800, Dmitry Torokhov wrote:
> > > On Mon, Nov 07, 2022 at 06:10:27PM +0200, Andy Shevchenko wrote:

...

> > > > +static int gpiochip_apply_reserved_ranges(struct gpio_chip *gc, unsigned int sz)
> > > > +{
> > > > +	u32 *ranges;
> > > > +	int ret;
> > > > +
> > > > +	ranges = kmalloc_array(sz, sizeof(*ranges), GFP_KERNEL);
> > > > +	if (!ranges)
> > > > +		return -ENOMEM;
> > > > +
> > > > +	ret = fwnode_property_read_u32_array(gc->fwnode, "gpio-reserved-ranges", ranges, sz);
> > > > +	if (ret) {
> > > > +		kfree(ranges);
> > > > +		return ret;
> > > > +	}
> > > > +
> > > > +	while (sz) {
> > > > +		u32 count = ranges[--sz];
> > > > +		u32 start = ranges[--sz];
> > > 
> > > I know we checked sz validity, but I wonder if re-checking it in this
> > > function would not insulate us from errors creeping in after some other
> > > code refactoring.
> > 
> > I'm not sure I understand what you meant. The fwnode_property_read_u32_array()
> > will fail if the given sz is too big for the real data, so while (sz) would
> > never even go on the invalid data.
> 
> I am more worried about sz being odd and the loop ending up trying to
> dereference ranges[-1].

I see. What if we take amount of ranges as the parameter and convert to size by
multiplying by 2?

-- 
With Best Regards,
Andy Shevchenko