diff mbox series

[5.10,112/131] gpio: wcd934x: Fix shift-out-of-bounds error

Message ID	20210614102656.812266049@linuxfoundation.org
State	Superseded
Headers	show Delivered-To: patch@linaro.org Received-SPF: pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Srinivas Kandagatla <srinivas.kandagatla@linaro.org>, Andy Shevchenko <andy.shevchenko@gmail.com>, Bjorn Andersson <bjorn.andersson@linaro.org>, Bartosz Golaszewski <bgolaszewski@baylibre.com> Subject: [PATCH 5.10 112/131] gpio: wcd934x: Fix shift-out-of-bounds error Date: Mon, 14 Jun 2021 12:27:53 +0200 Message-Id: <20210614102656.812266049@linuxfoundation.org> In-Reply-To: <20210614102652.964395392@linuxfoundation.org> References: <20210614102652.964395392@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [5.10,002/131] ASoC: max98088: fix ni clock divider calculation [5.10,004/131] spi: Fix spi device unregister flow [5.10,010/131] ASoC: Intel: bytcr_rt5640: Add quirk for the Lenovo Miix 3-830 tablet [5.10,012/131] vfio-ccw: Reset FSM state to IDLE inside FSM [5.10,014/131] ASoC: sti-sas: add missing MODULE_DEVICE_TABLE [5.10,016/131] usb: chipidea: udc: assign interrupt number to USB gadget structure [5.10,017/131] isdn: mISDN: netjet: Fix crash in nj_probe: [5.10,018/131] bonding: init notify_work earlier to avoid uninitialized use [5.10,022/131] wq: handle VM suspension in stall detection [5.10,025/131] net:sfc: fix non-freed irq in legacy irq mode [5.10,027/131] scsi: vmw_pvscsi: Set correct residual data length [5.10,028/131] scsi: hisi_sas: Drop free_irq() of devm_request_irq() allocated irq [5.10,029/131] scsi: target: qla2xxx: Wait for stop_phase1 at WWN removal [5.10,031/131] net: appletalk: cops: Fix data race in cops_probe1 [5.10,032/131] net: dsa: microchip: enable phy errata workaround on 9567 [5.10,034/131] MIPS: Fix kernel hang under FUNCTION_GRAPH_TRACER and PREEMPT_TRACER [5.10,035/131] dm verity: fix require_signatures module_param permissions [5.10,038/131] nvmet: fix false keep-alive timeout when a controller is torn down [5.10,039/131] powerpc/fsl: set fsl,i2c-erratum-a004447 flag for P2041 i2c controllers [5.10,041/131] spi: Dont have controller clean up spi device before driver unbind [5.10,042/131] spi: Cleanup on failure of initial setup [5.10,044/131] i2c: mpc: implement erratum A-004447 workaround [5.10,047/131] ALSA: hda/realtek: headphone and mic dont work on an Acer laptop [5.10,049/131] ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP EliteBook x360 1040 G8 [5.10,050/131] ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook 840 Aero G8 [5.10,054/131] drm: Fix use-after-free read in drm_getunique() [5.10,056/131] perf/x86/intel/uncore: Fix M2M event umask for Ice Lake server [5.10,058/131] kvm: avoid speculation-based attacks from out-of-range memslot accesses [5.10,062/131] btrfs: promote debugging asserts to full-fledged checks in validate_super [5.10,063/131] cgroup1: dont allow \n in renaming [5.10,066/131] mmc: renesas_sdhi: Fix HS400 on R-Car M3-W+ [5.10,067/131] USB: f_ncm: ncm_bitrate (speed) is unsigned [5.10,069/131] usb: pd: Set PD_T_SINK_WAIT_CAP to 310ms [5.10,071/131] usb: dwc3: meson-g12a: Disable the regulator in the error handling path of the probe [5.10,072/131] usb: dwc3: gadget: Bail from dwc3_gadget_exit() if dwc->gadget is NULL [5.10,073/131] usb: dwc3: debugfs: Add and remove endpoint dirs dynamically [5.10,074/131] usb: dwc3: ep0: fix NULL pointer exception [5.10,076/131] usb: typec: wcove: Use LE to CPU conversion when accessing msg->header [5.10,079/131] usb: typec: intel_pmc_mux: Add missed error check for devm_ioremap_resource() [5.10,080/131] usb: gadget: f_fs: Ensure io_completion_wq is idle during unbind [5.10,081/131] USB: serial: ftdi_sio: add NovaTech OrionMX product ID [5.10,083/131] USB: serial: quatech2: fix control-request directions [5.10,087/131] usb: fix various gadget panics on 10gbps cabling [5.10,088/131] usb: typec: tcpm: cancel vdm and state machine hrtimer when unregister tcpm port [5.10,090/131] regulator: core: resolve supply for boot-on/always-on regulators [5.10,091/131] regulator: max77620: Use device_set_of_node_from_dev() [5.10,094/131] regulator: bd71828: Fix .n_voltages settings [5.10,095/131] regulator: rtmv20: Fix .set_current_limit/.get_current_limit callbacks [5.10,096/131] phy: usb: Fix misuse of IS_ENABLED [5.10,098/131] usb: typec: mux: Fix copy-paste mistake in typec_mux_match [5.10,099/131] drm/mcde: Fix off by 10^3 in calculation [5.10,100/131] drm/msm/a6xx: fix incorrectly set uavflagprd_inv field for A650 [5.10,101/131] drm/msm/a6xx: update/fix CP_PROTECT initialization [5.10,105/131] ARM: cpuidle: Avoid orphan section warning [5.10,106/131] vmlinux.lds.h: Avoid orphan section with !SMP [5.10,107/131] tools/bootconfig: Fix error return code in apply_xbc() [5.10,108/131] phy: cadence: Sierra: Fix error return code in cdns_sierra_phy_probe() [5.10,109/131] ASoC: core: Fix Null-point-dereference in fmt_single_name() [5.10,110/131] ASoC: meson: gx-card: fix sound-dai dt schema [5.10,112/131] gpio: wcd934x: Fix shift-out-of-bounds error [5.10,114/131] sched/fair: Keep load_avg and load_sum synced [5.10,115/131] sched/fair: Make sure to update tg contrib for blocked load [5.10,116/131] sched/fair: Fix util_est UTIL_AVG_UNCHANGED handling [5.10,121/131] NFSv4: Fix deadlock between nfs4_evict_inode() and nfs4_opendata_get_inode() [5.10,122/131] perf session: Correct buffer copying when peeking events [5.10,123/131] kvm: fix previous commit for 32-bit builds [5.10,124/131] NFS: Fix use-after-free in nfs4_init_client() [5.10,128/131] scsi: core: Fix failure handling of scsi_add_host_with_dma() [5.10,129/131] scsi: core: Put .shost_dev in failure path if host state changes to RUNNING [5.10,130/131] scsi: core: Only put parent device if host state differs from SHOST_CREATED

Commit Message

gregkh@linuxfoundation.org June 14, 2021, 10:27 a.m. UTC

From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>


commit dbec64b11c65d74f31427e2b9d5746fbf17bf840 upstream.

bit-mask for pins 0 to 4 is BIT(0) to BIT(4) however we ended up with BIT(n - 1)
which is not right, and this was caught by below usban check

UBSAN: shift-out-of-bounds in drivers/gpio/gpio-wcd934x.c:34:14

Fixes: 59c324683400 ("gpio: wcd934x: Add support to wcd934x gpio controller")
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>

Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>

Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>

Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpio/gpio-wcd934x.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff mbox series

Patch

--- a/drivers/gpio/gpio-wcd934x.c
+++ b/drivers/gpio/gpio-wcd934x.c
@@ -7,7 +7,7 @@ 
 #include <linux/slab.h>
 #include <linux/of_device.h>
 
-#define WCD_PIN_MASK(p) BIT(p - 1)
+#define WCD_PIN_MASK(p) BIT(p)
 #define WCD_REG_DIR_CTL_OFFSET 0x42
 #define WCD_REG_VAL_CTL_OFFSET 0x43
 #define WCD934X_NPINS		5