Re: [PATCH v2] gpio: line-mux: fix unsigned truncation of property count error

[Jonas Jelonek <jelonek.jonas@gmail.com>]

Hi Shao,

On 10.11.26 15:57, shao.mingyin@zte.com.cn wrote:
> From: Shao Mingyin <shao.mingyin@zte.com.cn>
>
> device_property_count_u32() returns an int and reports errors with a
> negative errno (e.g. -EINVAL when the "gpio-line-mux-states" property is
> missing).  Storing that into an unsigned int turns -EINVAL into a huge
> value, so the "if (!ngpio)" guard never triggers and struct_size() then
> computes a huge size.  The allocation fails with -ENOMEM, hiding the
> real error; struct_size() saturates on overflow, so this is not an
> undersized allocation on 32-bit builds either.
>
> Use a signed int for the count, propagate the property-array error, and
> reject a zero count.
>
> Fixes: 2b03d9a40cd1 ("gpio: add gpio-line-mux driver")
> Signed-off-by: Shao Mingyin <shao.mingyin@zte.com.cn>
> Reviewed-by: Jonas Jelonek <jelonek.jonas@gmail.com>
> ---
> This patch supersedes 5/5 of the v1 series; 1/5 has been withdrawn and
> 2/5-4/5 are unchanged.
>
> v2:
>   - keep the declarations in reverse christmas tree order; merge
>     "int ngpio, ret" (Jonas Jelonek)
>   - propagate the property-array errno when ngpio < 0, and map only a
>     zero count to -EINVAL (Jonas Jelonek)
> v1: https://lore.kernel.org/all/20261107161258203oCy-Pa4_0rNe65TqrzFWD@zte.com.cn/
>
>  drivers/gpio/gpio-line-mux.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/gpio/gpio-line-mux.c b/drivers/gpio/gpio-line-mux.c
> index b4452d956bf0271d25598de2117c0db73805aba6..00b69632c4401300d11bbc296306df114d18c08f 100644
> --- a/drivers/gpio/gpio-line-mux.c
> +++ b/drivers/gpio/gpio-line-mux.c
> @@ -48,11 +48,12 @@ static int gpio_lmux_probe(struct platform_device *pdev)
>  {
>  	struct device *dev = &pdev->dev;
>  	struct gpio_lmux *glm;
> -	unsigned int ngpio;
>  	size_t size;
> -	int ret;
> +	int ngpio, ret;
>  

I think you still need to move it up where 'unsigned int ngpio' was before 
for RCT.

>  	ngpio = device_property_count_u32(dev, "gpio-line-mux-states");
> +	if (ngpio < 0)
> +		return ngpio;
>  	if (!ngpio)
>  		return -EINVAL;
>  

Best,
Jonas