Commit b981e9e9 authored by Dmitry Torokhov's avatar Dmitry Torokhov Committed by Ingo Molnar
Browse files

x86/platform/geode: Fix on-stack property data use-after-return bug 



The PROPERTY_ENTRY_GPIO macro (and by extension PROPERTY_ENTRY_REF)
creates a temporary software_node_ref_args structure on the stack
when used in a runtime assignment. This results in the property
pointing to data that is invalid once the function returns.

Fix this by ensuring the GPIO reference data is not stored on stack and
using PROPERTY_ENTRY_REF_ARRAY_LEN() to point directly to the persistent
reference data.

Fixes: 298c9bab ("x86/platform/geode: switch GPIO buttons and LEDs to software properties")
Signed-off-by: default avatarDmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
Cc: Rafael J. Wysocki <rafael@kernel.org>
Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Cc: Daniel Scally <djrscally@gmail.com>
Cc: Danilo Krummrich <dakr@kernel.org>
Cc: Hans de Goede <hansg@kernel.org>
Cc: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Cc: Sakari Ailus <sakari.ailus@linux.intel.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260329-property-gpio-fix-v2-1-3cca5ba136d8@gmail.com
parent 917e3ad3

arch/x86/platform/geode/geode-common.c

+18 −6
Original line number Diff line number Diff line
@@ -28,8 +28,10 @@ static const struct software_node geode_gpio_keys_node = { 
	.properties = geode_gpio_keys_props,

};



static struct property_entry geode_restart_key_props[] = {

	{ /* Placeholder for GPIO property */ },

static struct software_node_ref_args geode_restart_gpio_ref;



static const struct property_entry geode_restart_key_props[] = {

	PROPERTY_ENTRY_REF_ARRAY_LEN("gpios", &geode_restart_gpio_ref, 1),

	PROPERTY_ENTRY_U32("linux,code", KEY_RESTART),

	PROPERTY_ENTRY_STRING("label", "Reset button"),

	PROPERTY_ENTRY_U32("debounce-interval", 100),
@@ -64,8 +66,7 @@ int __init geode_create_restart_key(unsigned int pin) 
	struct platform_device *pd;

	int err;



	geode_restart_key_props[0] = PROPERTY_ENTRY_GPIO("gpios",

							 &geode_gpiochip_node,

	geode_restart_gpio_ref = SOFTWARE_NODE_REFERENCE(&geode_gpiochip_node,

							 pin, GPIO_ACTIVE_LOW);



	err = software_node_register_node_group(geode_gpio_keys_swnodes);
@@ -99,6 +100,7 @@ int __init geode_create_leds(const char *label, const struct geode_led *leds, 
	const struct software_node *group[MAX_LEDS + 2] = { 0 };

	struct software_node *swnodes;

	struct property_entry *props;

	struct software_node_ref_args *gpio_refs;

	struct platform_device_info led_info = {

		.name	= "leds-gpio",

		.id	= PLATFORM_DEVID_NONE,
@@ -127,6 +129,12 @@ int __init geode_create_leds(const char *label, const struct geode_led *leds, 
		goto err_free_swnodes;

	}



	gpio_refs = kzalloc_objs(*gpio_refs, n_leds);

	if (!gpio_refs) {

		err = -ENOMEM;

		goto err_free_props;

	}



	group[0] = &geode_gpio_leds_node;

	for (i = 0; i < n_leds; i++) {

		node_name = kasprintf(GFP_KERNEL, "%s:%d", label, i);
@@ -135,9 +143,11 @@ int __init geode_create_leds(const char *label, const struct geode_led *leds, 
			goto err_free_names;

		}



		gpio_refs[i] = SOFTWARE_NODE_REFERENCE(&geode_gpiochip_node,

						       leds[i].pin,

						       GPIO_ACTIVE_LOW);

		props[i * 3 + 0] =

			PROPERTY_ENTRY_GPIO("gpios", &geode_gpiochip_node,

					    leds[i].pin, GPIO_ACTIVE_LOW);

			PROPERTY_ENTRY_REF_ARRAY_LEN("gpios", &gpio_refs[i], 1);

		props[i * 3 + 1] =

			PROPERTY_ENTRY_STRING("linux,default-trigger",

					      leds[i].default_on ?
@@ -171,6 +181,8 @@ int __init geode_create_leds(const char *label, const struct geode_led *leds, 
err_free_names:

	while (--i >= 0)

		kfree(swnodes[i].name);

	kfree(gpio_refs);

err_free_props:

	kfree(props);

err_free_swnodes:

	kfree(swnodes);