From: Tomi Valkeinen Date: Thu, 9 Jan 2014 12:50:29 +0000 (+0200) Subject: pinctrl: single: fix infinite loop caused by bad mask X-Git-Tag: v3.14-rc1~144^2~11 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=ad5d25fef8f9459a9f67ec5fbae94287fdea3247;p=platform%2Fkernel%2Flinux-stable.git pinctrl: single: fix infinite loop caused by bad mask commit 4e7e8017a80e1 (pinctrl: pinctrl-single: enhance to configure multiple pins of different modules) improved support for pinctrl-single,bits option, but also caused a regression in parsing badly configured mask data. If the masks in DT data are not quite right, pcs_parse_bits_in_pinctrl_entry() can end up in an infinite loop, trashing memory at the same time. Add a check to verify that each loop actually removes bits from the 'mask', so that the loop can eventually end. Signed-off-by: Tomi Valkeinen Acked-by: Tony Lindgren Signed-off-by: Linus Walleij --- diff --git a/drivers/pinctrl/pinctrl-single.c b/drivers/pinctrl/pinctrl-single.c index 174f4c5..de64596 100644 --- a/drivers/pinctrl/pinctrl-single.c +++ b/drivers/pinctrl/pinctrl-single.c @@ -1318,6 +1318,14 @@ static int pcs_parse_bits_in_pinctrl_entry(struct pcs_device *pcs, mask_pos = ((pcs->fmask) << (bit_pos - 1)); val_pos = val & mask_pos; submask = mask & mask_pos; + + if ((mask & mask_pos) == 0) { + dev_err(pcs->dev, + "Invalid mask for %s at 0x%x\n", + np->name, offset); + break; + } + mask &= ~mask_pos; if (submask != mask_pos) {