redonkable/remarkable-linux
redonkable/remarkable-linux
1
0
Fork 0
Code Releases Activity

gpio: mcp23s08: fixed count variable for devicetree probing

Browse source 
Fixed missing increase of count variable for devicetree path in driver
probing.

The gpio-mcp23s08 driver has two paths for getting the platform
registration information. One for the classic platform initialization
and one for openfirmware devicetree based initialization. The devicetree
based path is missing the increase of the count variable, which results
in the count variable to become negative in the later use, where it is
decreased. The count variable is used as an index into a vector. This
results in accessing invalid memory space and can result in an exception.

Tested this with an AM3352 SoC with two mcp23s17 on two chip selects as
well as on a shared chip select.

Signed-off-by: Michael Stickel <ms@mycable.de>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
This commit is contained in:
Michael Stickel 2014-05-26 10:03:16 +02:00 committed by Linus Walleij
parent 821e85f2a8
commit 3e3bed913e
1 changed files with 10 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
drivers/gpio/gpio-mcp23s08.c
View file

@ -895,8 +895,13 @@ static int mcp23s08_probe(struct spi_device *spi)
return -ENODEV;
}
for (addr = 0; addr < ARRAY_SIZE(pdata->chip); addr++)
for (addr = 0; addr < ARRAY_SIZE(pdata->chip); addr++) {
pullups[addr] = 0;
if (spi_present_mask & (1 << addr))
chips++;
}
if (!chips)
return -ENODEV;
} else {
type = spi_get_device_id(spi)->driver_data;
pdata = dev_get_platdata(&spi->dev);
@ -935,6 +940,10 @@ static int mcp23s08_probe(struct spi_device *spi)
if (!(spi_present_mask & (1 << addr)))
continue;
chips--;
if (chips < 0) {
dev_err(&spi->dev, "FATAL: invalid negative chip id\n");
goto fail;
}
data->mcp[addr] = &data->chip[chips];
status = mcp23s08_probe_one(data->mcp[addr], &spi->dev, spi,
0x40 | (addr << 1), type, base,