This is a note to let you know that I've just added the patch titled
gpio: 74x164: Fix crash during .remove()
to the 4.14-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git%3Ba=su...
The filename of the patch is: gpio-74x164-fix-crash-during-.remove.patch and it can be found in the queue-4.14 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree, please let stable@vger.kernel.org know about it.
From foo@baz Fri Feb 23 11:45:09 CET 2018
From: Geert Uytterhoeven geert+renesas@glider.be Date: Tue, 21 Nov 2017 15:18:10 +0100 Subject: gpio: 74x164: Fix crash during .remove()
From: Geert Uytterhoeven geert+renesas@glider.be
[ Upstream commit a158531f3c92467df0e93e000d58185acae78a6e ]
Commit 7ebc194d0fd4bb0f ("gpio: 74x164: Introduce 'enable-gpios' property") added a new member gpiod_oe to the end of the struct gen_74x164_chip, after the zero-length buffer array.
However, this buffer is a flexible array, allocated together with the structure during .probe(). As the buffer is no longer the last member, writing to it corrupts the newly added member after it. During device removal, the corrupted member will be used as a pointer, leading to a crash.
This went unnoticed, as the flexible array was declared as "buffer[0]" instead of "buffer[]", and thus did not trigger a "flexible array member not at end of struct" error from gcc.
Move the gpiod_oe field up to fix this, and drop the zero from the array size to prevent future similar bugs.
Fixes: 7ebc194d0fd4bb0f ("gpio: 74x164: Introduce 'enable-gpios' property") Signed-off-by: Geert Uytterhoeven geert+renesas@glider.be Reviewed-by: Fabio Estevam fabio.estevam@nxp.com Signed-off-by: Linus Walleij linus.walleij@linaro.org Signed-off-by: Sasha Levin alexander.levin@verizon.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/gpio/gpio-74x164.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/gpio/gpio-74x164.c +++ b/drivers/gpio/gpio-74x164.c @@ -23,6 +23,7 @@ struct gen_74x164_chip { struct gpio_chip gpio_chip; struct mutex lock; + struct gpio_desc *gpiod_oe; u32 registers; /* * Since the registers are chained, every byte sent will make @@ -31,8 +32,7 @@ struct gen_74x164_chip { * register at the end of the transfer. So, to have a logical * numbering, store the bytes in reverse order. */ - u8 buffer[0]; - struct gpio_desc *gpiod_oe; + u8 buffer[]; };
static int __gen_74x164_write_config(struct gen_74x164_chip *chip)
Patches currently in stable-queue which might be from geert+renesas@glider.be are
queue-4.14/gpio-74x164-fix-crash-during-.remove.patch queue-4.14/pci-rcar-fix-use-after-free-in-probe-error-path.patch