This is a note to let you know that I've just added the patch titled pinctrl: core: handle radix_tree_insert() errors in pinctrl_register_one_pin() to the 6.1-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: pinctrl-core-handle-radix_tree_insert-errors-in-pinctrl_register_one_pin.patch and it can be found in the queue-6.1 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From ecfe9a015d3e1e46504d5b3de7eef1f2d186194a Mon Sep 17 00:00:00 2001 From: Sergey Shtylyov <s.shtylyov@xxxxxx> Date: Wed, 19 Jul 2023 23:22:52 +0300 Subject: pinctrl: core: handle radix_tree_insert() errors in pinctrl_register_one_pin() From: Sergey Shtylyov <s.shtylyov@xxxxxx> commit ecfe9a015d3e1e46504d5b3de7eef1f2d186194a upstream. pinctrl_register_one_pin() doesn't check the result of radix_tree_insert() despite they both may return a negative error code. Linus Walleij said he has copied the radix tree code from kernel/irq/ where the functions calling radix_tree_insert() are *void* themselves; I think it makes more sense to propagate the errors from radix_tree_insert() upstream if we can do that... Found by Linux Verification Center (linuxtesting.org) with the Svace static analysis tool. Signed-off-by: Sergey Shtylyov <s.shtylyov@xxxxxx> Link: https://lore.kernel.org/r/20230719202253.13469-3-s.shtylyov@xxxxxx Signed-off-by: Linus Walleij <linus.walleij@xxxxxxxxxx> Cc: "Hemdan, Hagar Gamal Halim" <hagarhem@xxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- drivers/pinctrl/core.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) --- a/drivers/pinctrl/core.c +++ b/drivers/pinctrl/core.c @@ -205,6 +205,7 @@ static int pinctrl_register_one_pin(stru const struct pinctrl_pin_desc *pin) { struct pin_desc *pindesc; + int error; pindesc = pin_desc_get(pctldev, pin->number); if (pindesc) { @@ -226,18 +227,25 @@ static int pinctrl_register_one_pin(stru } else { pindesc->name = kasprintf(GFP_KERNEL, "PIN%u", pin->number); if (!pindesc->name) { - kfree(pindesc); - return -ENOMEM; + error = -ENOMEM; + goto failed; } pindesc->dynamic_name = true; } pindesc->drv_data = pin->drv_data; - radix_tree_insert(&pctldev->pin_desc_tree, pin->number, pindesc); + error = radix_tree_insert(&pctldev->pin_desc_tree, pin->number, pindesc); + if (error) + goto failed; + pr_debug("registered pin %d (%s) on %s\n", pin->number, pindesc->name, pctldev->desc->name); return 0; + +failed: + kfree(pindesc); + return error; } static int pinctrl_register_pins(struct pinctrl_dev *pctldev, Patches currently in stable-queue which might be from s.shtylyov@xxxxxx are queue-6.1/pinctrl-core-handle-radix_tree_insert-errors-in-pinctrl_register_one_pin.patch