[PATCH v2] gpio: line-mux: fix unsigned truncation of property count error

[PATCH v2] gpio: line-mux: fix unsigned truncation of property count error

[shao.mingyin]

From: Shao Mingyin <shao.mingyin@zte.com.cn>

device_property_count_u32() returns an int and reports errors with a
negative errno (e.g. -EINVAL when the "gpio-line-mux-states" property is
missing).  Storing that into an unsigned int turns -EINVAL into a huge
value, so the "if (!ngpio)" guard never triggers and struct_size() then
computes a huge size.  The allocation fails with -ENOMEM, hiding the
real error; struct_size() saturates on overflow, so this is not an
undersized allocation on 32-bit builds either.

Use a signed int for the count, propagate the property-array error, and
reject a zero count.

Fixes: 2b03d9a40cd1 ("gpio: add gpio-line-mux driver")
Signed-off-by: Shao Mingyin <shao.mingyin@zte.com.cn>
Reviewed-by: Jonas Jelonek <jelonek.jonas@gmail.com>
---
This patch supersedes 5/5 of the v1 series; 1/5 has been withdrawn and
2/5-4/5 are unchanged.

v2:
  - keep the declarations in reverse christmas tree order; merge
    "int ngpio, ret" (Jonas Jelonek)
  - propagate the property-array errno when ngpio < 0, and map only a
    zero count to -EINVAL (Jonas Jelonek)
v1: https://lore.kernel.org/all/20261107161258203oCy-Pa4_0rNe65TqrzFWD@zte.com.cn/

 drivers/gpio/gpio-line-mux.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/gpio/gpio-line-mux.c b/drivers/gpio/gpio-line-mux.c
index b4452d956bf0271d25598de2117c0db73805aba6..00b69632c4401300d11bbc296306df114d18c08f 100644
--- a/drivers/gpio/gpio-line-mux.c
+++ b/drivers/gpio/gpio-line-mux.c
@@ -48,11 +48,12 @@ static int gpio_lmux_probe(struct platform_device *pdev)
 {
 	struct device *dev = &pdev->dev;
 	struct gpio_lmux *glm;
-	unsigned int ngpio;
 	size_t size;
-	int ret;
+	int ngpio, ret;
 
 	ngpio = device_property_count_u32(dev, "gpio-line-mux-states");
+	if (ngpio < 0)
+		return ngpio;
 	if (!ngpio)
 		return -EINVAL;
 
-- 
2.27.0

Re: [PATCH v2] gpio: line-mux: fix unsigned truncation of property count error

[Bartosz Golaszewski]

On Tue, Nov 10, 2026 at 10:57:42PM +0800, shao.mingyin@zte.com.cn wrote:
> From: Shao Mingyin <shao.mingyin@zte.com.cn>
> 
> device_property_count_u32() returns an int and reports errors with a
> negative errno (e.g. -EINVAL when the "gpio-line-mux-states" property is
> missing).  Storing that into an unsigned int turns -EINVAL into a huge
> value, so the "if (!ngpio)" guard never triggers and struct_size() then
> computes a huge size.  The allocation fails with -ENOMEM, hiding the
> real error; struct_size() saturates on overflow, so this is not an
> undersized allocation on 32-bit builds either.
> 
> Use a signed int for the count, propagate the property-array error, and
> reject a zero count.
> 
> Fixes: 2b03d9a40cd1 ("gpio: add gpio-line-mux driver")
> Signed-off-by: Shao Mingyin <shao.mingyin@zte.com.cn>
> Reviewed-by: Jonas Jelonek <jelonek.jonas@gmail.com>
> ---
> This patch supersedes 5/5 of the v1 series; 1/5 has been withdrawn and
> 2/5-4/5 are unchanged.
>

When sending a new version of a series, you must include all patches, even if
some of them didn't change. You can't expect maintainers to comb through
lore.kernel.org in search of all the pieces.

Please resend it as a complete series.

Bartosz

Re: [PATCH v2] gpio: line-mux: fix unsigned truncation of property count error

[shao.mingyin]

On Tue, 2026-11-10 at 16:17 +0100, Bartosz Golaszewski wrote:
> When sending a new version of a series, you must include all patches, even if
> some of them didn't change. You can't expect maintainers to comb through
> lore.kernel.org in search of all the pieces.
> 
> Please resend it as a complete series.

Right, I'll repost the whole set.  One clarification: 1/5 (rcar) was
withdrawn after Geert's NAK, so the complete series is the remaining four
patches.  I'm sending it as

  [PATCH v2 0/4] gpio: fix IRQ handling and probe error paths in four drivers

with the Reviewed-by/Acked-by tags picked up on the three patches that
did not change.

Best,
Shao Mingyin

Re: [PATCH v2] gpio: line-mux: fix unsigned truncation of property count error

[Jonas Jelonek]

Hi Shao,

On 10.11.26 15:57, shao.mingyin@zte.com.cn wrote:
> From: Shao Mingyin <shao.mingyin@zte.com.cn>
>
> device_property_count_u32() returns an int and reports errors with a
> negative errno (e.g. -EINVAL when the "gpio-line-mux-states" property is
> missing).  Storing that into an unsigned int turns -EINVAL into a huge
> value, so the "if (!ngpio)" guard never triggers and struct_size() then
> computes a huge size.  The allocation fails with -ENOMEM, hiding the
> real error; struct_size() saturates on overflow, so this is not an
> undersized allocation on 32-bit builds either.
>
> Use a signed int for the count, propagate the property-array error, and
> reject a zero count.
>
> Fixes: 2b03d9a40cd1 ("gpio: add gpio-line-mux driver")
> Signed-off-by: Shao Mingyin <shao.mingyin@zte.com.cn>
> Reviewed-by: Jonas Jelonek <jelonek.jonas@gmail.com>
> ---
> This patch supersedes 5/5 of the v1 series; 1/5 has been withdrawn and
> 2/5-4/5 are unchanged.
>
> v2:
>   - keep the declarations in reverse christmas tree order; merge
>     "int ngpio, ret" (Jonas Jelonek)
>   - propagate the property-array errno when ngpio < 0, and map only a
>     zero count to -EINVAL (Jonas Jelonek)
> v1: https://lore.kernel.org/all/20261107161258203oCy-Pa4_0rNe65TqrzFWD@zte.com.cn/
>
>  drivers/gpio/gpio-line-mux.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/gpio/gpio-line-mux.c b/drivers/gpio/gpio-line-mux.c
> index b4452d956bf0271d25598de2117c0db73805aba6..00b69632c4401300d11bbc296306df114d18c08f 100644
> --- a/drivers/gpio/gpio-line-mux.c
> +++ b/drivers/gpio/gpio-line-mux.c
> @@ -48,11 +48,12 @@ static int gpio_lmux_probe(struct platform_device *pdev)
>  {
>  	struct device *dev = &pdev->dev;
>  	struct gpio_lmux *glm;
> -	unsigned int ngpio;
>  	size_t size;
> -	int ret;
> +	int ngpio, ret;
>  

I think you still need to move it up where 'unsigned int ngpio' was before 
for RCT.

>  	ngpio = device_property_count_u32(dev, "gpio-line-mux-states");
> +	if (ngpio < 0)
> +		return ngpio;
>  	if (!ngpio)
>  		return -EINVAL;
>  

Best,
Jonas