[PATCH] gpio: mvebu: validate ngpios before use

[PATCH] gpio: mvebu: validate ngpios before use

[Rosen Penev]

If ngpios is read as 0 from device tree, it is passed via
irq_alloc_domain_generic_chips() as irqs_per_chip, which leads to a
division by zero in DIV_ROUND_UP(d->revmap_size, irqs_per_chip).
Reject ngpios == 0 early.

Fixes: fefe7b0923459 ("gpio: introduce gpio-mvebu driver for Marvell SoCs")
Assisted-by: opencode:big-pickle
Signed-off-by: Rosen Penev <rosenp@gmail.com>
---
 drivers/gpio/gpio-mvebu.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/gpio/gpio-mvebu.c b/drivers/gpio/gpio-mvebu.c
index 39c1a13e1b65..c7cbfbfb4800 100644
--- a/drivers/gpio/gpio-mvebu.c
+++ b/drivers/gpio/gpio-mvebu.c
@@ -1175,6 +1175,11 @@ static int mvebu_gpio_probe(struct platform_device *pdev)
 		return -ENODEV;
 	}
 
+	if (!ngpios) {
+		dev_err(&pdev->dev, "ngpios must be greater than 0\n");
+		return -EINVAL;
+	}
+
 	id = of_alias_get_id(pdev->dev.of_node, "gpio");
 	if (id < 0) {
 		dev_err(&pdev->dev, "Couldn't get OF id\n");
-- 
2.55.0

Re: [PATCH] gpio: mvebu: validate ngpios before use

[Bartosz Golaszewski]

On Wed, 8 Jul 2026 01:27:42 +0200, Rosen Penev <rosenp@gmail.com> said:
> If ngpios is read as 0 from device tree, it is passed via
> irq_alloc_domain_generic_chips() as irqs_per_chip, which leads to a
> division by zero in DIV_ROUND_UP(d->revmap_size, irqs_per_chip).
> Reject ngpios == 0 early.
>
> Fixes: fefe7b0923459 ("gpio: introduce gpio-mvebu driver for Marvell SoCs")
> Assisted-by: opencode:big-pickle
> Signed-off-by: Rosen Penev <rosenp@gmail.com>
> ---
>  drivers/gpio/gpio-mvebu.c | 5 +++++
>  1 file changed, 5 insertions(+)
>
> diff --git a/drivers/gpio/gpio-mvebu.c b/drivers/gpio/gpio-mvebu.c
> index 39c1a13e1b65..c7cbfbfb4800 100644
> --- a/drivers/gpio/gpio-mvebu.c
> +++ b/drivers/gpio/gpio-mvebu.c
> @@ -1175,6 +1175,11 @@ static int mvebu_gpio_probe(struct platform_device *pdev)
>  		return -ENODEV;
>  	}
>
> +	if (!ngpios) {
> +		dev_err(&pdev->dev, "ngpios must be greater than 0\n");

return dev_err_probe()?

> +		return -EINVAL;
> +	}
> +
>  	id = of_alias_get_id(pdev->dev.of_node, "gpio");
>  	if (id < 0) {
>  		dev_err(&pdev->dev, "Couldn't get OF id\n");
> --
> 2.55.0
>
>

Re: [PATCH] gpio: mvebu: validate ngpios before use

[Rosen Penev]

On Wed, Jul 8, 2026 at 5:06 AM Bartosz Golaszewski <brgl@kernel.org> wrote:
>
> On Wed, 8 Jul 2026 01:27:42 +0200, Rosen Penev <rosenp@gmail.com> said:
> > If ngpios is read as 0 from device tree, it is passed via
> > irq_alloc_domain_generic_chips() as irqs_per_chip, which leads to a
> > division by zero in DIV_ROUND_UP(d->revmap_size, irqs_per_chip).
> > Reject ngpios == 0 early.
> >
> > Fixes: fefe7b0923459 ("gpio: introduce gpio-mvebu driver for Marvell SoCs")
> > Assisted-by: opencode:big-pickle
> > Signed-off-by: Rosen Penev <rosenp@gmail.com>
> > ---
> >  drivers/gpio/gpio-mvebu.c | 5 +++++
> >  1 file changed, 5 insertions(+)
> >
> > diff --git a/drivers/gpio/gpio-mvebu.c b/drivers/gpio/gpio-mvebu.c
> > index 39c1a13e1b65..c7cbfbfb4800 100644
> > --- a/drivers/gpio/gpio-mvebu.c
> > +++ b/drivers/gpio/gpio-mvebu.c
> > @@ -1175,6 +1175,11 @@ static int mvebu_gpio_probe(struct platform_device *pdev)
> >               return -ENODEV;
> >       }
> >
> > +     if (!ngpios) {
> > +             dev_err(&pdev->dev, "ngpios must be greater than 0\n");
Sashiko suggests upper limit bound as well.
>
> return dev_err_probe()?
surrounding code doesn't use it. dev_err_probe is mostly useful with
variable error codes anyway.
>
> > +             return -EINVAL;
> > +     }
> > +
> >       id = of_alias_get_id(pdev->dev.of_node, "gpio");
> >       if (id < 0) {
> >               dev_err(&pdev->dev, "Couldn't get OF id\n");
> > --
> > 2.55.0
> >
> >

Re: [PATCH] gpio: mvebu: validate ngpios before use

[Bartosz Golaszewski]

On Wed, 8 Jul 2026 21:18:25 +0200, Rosen Penev <rosenp@gmail.com> said:
> On Wed, Jul 8, 2026 at 5:06 AM Bartosz Golaszewski <brgl@kernel.org> wrote:
>>
>> On Wed, 8 Jul 2026 01:27:42 +0200, Rosen Penev <rosenp@gmail.com> said:
>> > If ngpios is read as 0 from device tree, it is passed via
>> > irq_alloc_domain_generic_chips() as irqs_per_chip, which leads to a
>> > division by zero in DIV_ROUND_UP(d->revmap_size, irqs_per_chip).
>> > Reject ngpios == 0 early.
>> >
>> > Fixes: fefe7b0923459 ("gpio: introduce gpio-mvebu driver for Marvell SoCs")
>> > Assisted-by: opencode:big-pickle
>> > Signed-off-by: Rosen Penev <rosenp@gmail.com>
>> > ---
>> >  drivers/gpio/gpio-mvebu.c | 5 +++++
>> >  1 file changed, 5 insertions(+)
>> >
>> > diff --git a/drivers/gpio/gpio-mvebu.c b/drivers/gpio/gpio-mvebu.c
>> > index 39c1a13e1b65..c7cbfbfb4800 100644
>> > --- a/drivers/gpio/gpio-mvebu.c
>> > +++ b/drivers/gpio/gpio-mvebu.c
>> > @@ -1175,6 +1175,11 @@ static int mvebu_gpio_probe(struct platform_device *pdev)
>> >               return -ENODEV;
>> >       }
>> >
>> > +     if (!ngpios) {
>> > +             dev_err(&pdev->dev, "ngpios must be greater than 0\n");
> Sashiko suggests upper limit bound as well.
>>
>> return dev_err_probe()?
> surrounding code doesn't use it. dev_err_probe is mostly useful with
> variable error codes anyway.

It doesn't use it becuase it didn't exist when this driver was written. If
you're touching it, you may as well use the more recent interface which saves
you a couple lines.

Bart

>>
>> > +             return -EINVAL;
>> > +     }
>> > +
>> >       id = of_alias_get_id(pdev->dev.of_node, "gpio");
>> >       if (id < 0) {
>> >               dev_err(&pdev->dev, "Couldn't get OF id\n");
>> > --
>> > 2.55.0
>> >
>> >
>