diff options
| author | Stefan Agner <stefan@agner.ch> | 2016-10-18 23:09:15 +0200 |
|---|---|---|
| committer | Linus Walleij <linus.walleij@linaro.org> | 2016-10-31 21:25:15 +0100 |
| commit | 9999fe5df58773489b9564467b5c8cfb364e0b80 (patch) | |
| tree | 85eb4e7a1fbcd5861ae84db0bf0f0da1a25b6a3b /drivers/pinctrl/freescale | |
| parent | pinctrl: stm32: move gpio irqs binding to optional (diff) | |
| download | linux-9999fe5df58773489b9564467b5c8cfb364e0b80.tar.xz linux-9999fe5df58773489b9564467b5c8cfb364e0b80.zip | |
pinctrl: imx: reset group index on probe
Group index is incremented on every new group parsed. Since the
field is part of struct imx_pinctrl_soc_info, which is typically
a global variable passed by the individual pinctrl-imx.c based
driver, it does not get cleared automatically when re-probing the
driver. This lead imx_pinctrl_parse_functions passing a group
pointer which is outside of the allocated group space on second
probe and onwards. Typically this ended up in a NULL pointer
dereference when accessing the name field like this:
Unable to handle kernel NULL pointer dereference at virtual address 00000000
...
PC is at strcmp+0x18/0x44
LR is at imx_dt_node_to_map+0xc4/0x290
Avoid this by setting group_index to 0 on probe.
This has been observed when using DEBUG_TEST_DRIVER_REMOVE.
Signed-off-by: Stefan Agner <stefan@agner.ch>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Diffstat (limited to 'drivers/pinctrl/freescale')
| -rw-r--r-- | drivers/pinctrl/freescale/pinctrl-imx.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/pinctrl/freescale/pinctrl-imx.c b/drivers/pinctrl/freescale/pinctrl-imx.c index 47613201269a..79c4e14a5a75 100644 --- a/drivers/pinctrl/freescale/pinctrl-imx.c +++ b/drivers/pinctrl/freescale/pinctrl-imx.c @@ -687,6 +687,7 @@ static int imx_pinctrl_probe_dt(struct platform_device *pdev, if (!info->functions) return -ENOMEM; + info->group_index = 0; if (flat_funcs) { info->ngroups = of_get_child_count(np); } else { |