Received: by 10.223.185.116 with SMTP id b49csp1073357wrg; Fri, 23 Feb 2018 11:26:01 -0800 (PST) X-Google-Smtp-Source: AH8x2256XjSeP2nOhEz3b5k290l/LPvyuktQG9IjDohty8ooeHXr1gY19c1pApGCjyZlSSYCHJFU X-Received: by 10.98.89.156 with SMTP id k28mr2737377pfj.130.1519413961285; Fri, 23 Feb 2018 11:26:01 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1519413961; cv=none; d=google.com; s=arc-20160816; b=z6cC98zVtZhP7xtBAXg7OhWR10wRD41r2sZKsQbk9hEwLc+fsMj1N1SI/wUPWmHBIu 0gxuBA3c46lgMz/xh3CDaM9pdDt5XOxhdxErzpAgkPB++lsJFvbXcLl+su6gl3L3+FyC VdvDrQgNdpNrDCTx7oDoFUHdMk7XP3/VlNVr3qu3LKtqwSKs7088WbdAkLxN55UwuO7H K7bynM7cB1X+7G1HSjU5UENPZTT+iUKTK5wUJm9/z0ZIqBiX3KN5rFcuDe93RPANICTd CzUDbgxQADxvYGqtJKJ/RgxB+wV20Xo3acezZqTBklD7jN5eS+jzgPtDcDnuQsZrQ4YQ 1D5Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:mime-version:user-agent:references :in-reply-to:message-id:date:subject:cc:to:from :arc-authentication-results; bh=S9a9tATbw06h9L7DdoSXdQ2UNleMV6WtVfFxBnnvEZ4=; b=m2RtCI/RIc5prn7kM1yfj2Q340jWoD+2x6QI/5wH0i8LQd7m10prJNhQgYaL1o3xqI G8Um8Cny0JzKh78D4QL6YcQyxWiMYhtGUmXnf9D6pj0U0LU8SbS5oDU78vOTtwYmTde7 Ob2GtI3uHy2J1ZwEdyoxRhToycKnQCMOKplMJSmpFBnoLtBvmiLbPEr+luUwO0M4TgPd 083I5+v5Wahd4qunOTtSGtu1KlNYtoOR0QYb2OK/zf6wkV6eiwLLE3V7wvWpJpLVMDdw bHk6O+g+2lQhJoSKy0yUjAlh5+v56V5bNVgVb1fRAeNeWGKbml2De3jwSc/ZVyHcQ0c3 ccZQ== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id a5-v6si2166734plh.450.2018.02.23.11.25.46; Fri, 23 Feb 2018 11:26:01 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S935259AbeBWSw4 (ORCPT + 99 others); Fri, 23 Feb 2018 13:52:56 -0500 Received: from mail.linuxfoundation.org ([140.211.169.12]:47142 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S935204AbeBWSwy (ORCPT ); Fri, 23 Feb 2018 13:52:54 -0500 Received: from localhost (LFbn-1-12258-90.w90-92.abo.wanadoo.fr [90.92.71.90]) by mail.linuxfoundation.org (Postfix) with ESMTPSA id BE9DC104F; Fri, 23 Feb 2018 18:52:53 +0000 (UTC) From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Geert Uytterhoeven , Fabio Estevam , Linus Walleij , Sasha Levin Subject: [PATCH 4.14 082/159] gpio: 74x164: Fix crash during .remove() Date: Fri, 23 Feb 2018 19:26:30 +0100 Message-Id: <20180223170753.496872487@linuxfoundation.org> X-Mailer: git-send-email 2.16.2 In-Reply-To: <20180223170743.086611315@linuxfoundation.org> References: <20180223170743.086611315@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 4.14-stable review patch. If anyone has any objections, please let me know. ------------------ From: Geert Uytterhoeven [ Upstream commit a158531f3c92467df0e93e000d58185acae78a6e ] Commit 7ebc194d0fd4bb0f ("gpio: 74x164: Introduce 'enable-gpios' property") added a new member gpiod_oe to the end of the struct gen_74x164_chip, after the zero-length buffer array. However, this buffer is a flexible array, allocated together with the structure during .probe(). As the buffer is no longer the last member, writing to it corrupts the newly added member after it. During device removal, the corrupted member will be used as a pointer, leading to a crash. This went unnoticed, as the flexible array was declared as "buffer[0]" instead of "buffer[]", and thus did not trigger a "flexible array member not at end of struct" error from gcc. Move the gpiod_oe field up to fix this, and drop the zero from the array size to prevent future similar bugs. Fixes: 7ebc194d0fd4bb0f ("gpio: 74x164: Introduce 'enable-gpios' property") Signed-off-by: Geert Uytterhoeven Reviewed-by: Fabio Estevam Signed-off-by: Linus Walleij Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman --- drivers/gpio/gpio-74x164.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/drivers/gpio/gpio-74x164.c +++ b/drivers/gpio/gpio-74x164.c @@ -23,6 +23,7 @@ struct gen_74x164_chip { struct gpio_chip gpio_chip; struct mutex lock; + struct gpio_desc *gpiod_oe; u32 registers; /* * Since the registers are chained, every byte sent will make @@ -31,8 +32,7 @@ struct gen_74x164_chip { * register at the end of the transfer. So, to have a logical * numbering, store the bytes in reverse order. */ - u8 buffer[0]; - struct gpio_desc *gpiod_oe; + u8 buffer[]; }; static int __gen_74x164_write_config(struct gen_74x164_chip *chip)