[PATCH v2] Input: gpio_keys - fix NULL pointer dereference for dt case

Commit 30161f6b2e7d1 (Input: gpio_keys - clean up device tree parser) 
introduced the following kernel crash for a dt based kernel:
..
Unable to handle kernel NULL pointer dereference at virtual address 00000004
pgd = 80004000
[00000004] *pgd=00000000
Internal error: Oops: 805 [#1] ARM
Modules linked in:
CPU: 0    Not tainted  (3.5.0-next-20120802+ #1366)
PC is at gpio_keys_probe+0x154/0x8c0
LR is at of_gpiochip_find_and_xlate+0x54/0x70
pc : [<803ddbac>]    lr : [<801ed2f4>]    psr: 60000013
sp : 9f851df8  ip : 00000002  fp : 9f851e5c
r10: 9f873d00  r9 : 00000001  r8 : 9fa2f900
r7 : 809c0920  r6 : 9f873d08  r5 : 00000000  r4 : 809c09d4
r3 : 805af10c  r2 : 000000c0  r1 : 9f851db4  r0 : 000000d5
Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment kernel
Control: 10c5387d  Table: 90004019  DAC: 00000015
Process swapper (pid: 1, stack limit = 0x9f8502e8)
Stack: (0x9f851df8 to 0x9f852000)
....

The reason for the crash was due to 'button = &pdata->buttons[i++];' 
returning a NULL pointer, and then 'button' was accessed afterwards 
without checking for NULL.

Fix this by correctly assigning 'pdata->buttons' and also add a NULL 
pointer check for 'button' pointer.

Signed-off-by: Fabio Estevam <redacted>
---
Changes since v1:
- Fix the location of 'button = pdata->buttons'. This fixes the probing of multiple keys.

 drivers/input/keyboard/gpio_keys.c |   13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/drivers/input/keyboard/gpio_keys.c b/drivers/input/keyboard/gpio_keys.c
index 6ee68ec..c90c152 100644
--- a/drivers/input/keyboard/gpio_keys.c
+++ b/drivers/input/keyboard/gpio_keys.c

@@ -559,7 +559,6 @@ gpio_keys_get_devtree_pdata(struct device *dev)
 	struct gpio_keys_button *button;
 	int error;
 	int nbuttons;
-	int i;
 
 	node = dev->of_node;
 	if (!node) {

@@ -580,9 +579,12 @@ gpio_keys_get_devtree_pdata(struct device *dev)
 		goto err_out;
 	}
 
+	pdata->buttons = (struct gpio_keys_button *) (pdata + 1);
+	pdata->nbuttons = nbuttons;
+
 	pdata->rep = !!of_get_property(node, "autorepeat", NULL);
+	button = pdata->buttons;
 
-	i = 0;
 	for_each_child_of_node(node, pp) {
 		enum of_gpio_flags flags;
 

@@ -592,7 +594,10 @@ gpio_keys_get_devtree_pdata(struct device *dev)
 			continue;
 		}
 
-		button = &pdata->buttons[i++];
+		if (!button) {
+			error = -ENOMEM;
+			goto err_free_pdata;
+		}
 
 		button->gpio = of_get_gpio_flags(pp, 0, &flags);
 		button->active_low = flags & OF_GPIO_ACTIVE_LOW;

@@ -614,6 +619,8 @@ gpio_keys_get_devtree_pdata(struct device *dev)
 		if (of_property_read_u32(pp, "debounce-interval",
 					 &button->debounce_interval))
 			button->debounce_interval = 5;
+
+		button++;
 	}
 
 	if (pdata->nbuttons == 0) {

-- 
1.7.9.5

On 20 August 2012 19:48, Fabio Estevam [off-list ref] wrote:

Tested-by: Alan M Butler <redacted>

On Mon, Aug 20, 2012 at 09:44:40PM +0100, Alan M Butler wrote:

On 20 August 2012 19:48, Fabio Estevam [off-list ref] wrote:

quoted

Commit 30161f6b2e7d1 (Input: gpio_keys - clean up device tree parser)
introduced the following kernel crash for a dt based kernel:
..
Unable to handle kernel NULL pointer dereference at virtual address 00000004
pgd = 80004000
[00000004] *pgd=00000000
Internal error: Oops: 805 [#1] ARM
Modules linked in:
CPU: 0    Not tainted  (3.5.0-next-20120802+ #1366)
PC is at gpio_keys_probe+0x154/0x8c0
LR is at of_gpiochip_find_and_xlate+0x54/0x70
pc : [<803ddbac>]    lr : [<801ed2f4>]    psr: 60000013
sp : 9f851df8  ip : 00000002  fp : 9f851e5c
r10: 9f873d00  r9 : 00000001  r8 : 9fa2f900
r7 : 809c0920  r6 : 9f873d08  r5 : 00000000  r4 : 809c09d4
r3 : 805af10c  r2 : 000000c0  r1 : 9f851db4  r0 : 000000d5
Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment kernel
Control: 10c5387d  Table: 90004019  DAC: 00000015
Process swapper (pid: 1, stack limit = 0x9f8502e8)
Stack: (0x9f851df8 to 0x9f852000)
....

The reason for the crash was due to 'button = &pdata->buttons[i++];'
returning a NULL pointer, and then 'button' was accessed afterwards
without checking for NULL.

Fix this by correctly assigning 'pdata->buttons' and also add a NULL
pointer check for 'button' pointer.

Signed-off-by: Fabio Estevam <redacted>
---
Changes since v1:
- Fix the location of 'button = pdata->buttons'. This fixes the probing of multiple keys.

 drivers/input/keyboard/gpio_keys.c |   13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/drivers/input/keyboard/gpio_keys.c b/drivers/input/keyboard/gpio_keys.c
index 6ee68ec..c90c152 100644
--- a/drivers/input/keyboard/gpio_keys.c
+++ b/drivers/input/keyboard/gpio_keys.c

@@ -559,7 +559,6 @@ gpio_keys_get_devtree_pdata(struct device *dev)
        struct gpio_keys_button *button;
        int error;
        int nbuttons;
-       int i;

        node = dev->of_node;
        if (!node) {

@@ -580,9 +579,12 @@ gpio_keys_get_devtree_pdata(struct device *dev)
                goto err_out;
        }

+       pdata->buttons = (struct gpio_keys_button *) (pdata + 1);
+       pdata->nbuttons = nbuttons;
+
        pdata->rep = !!of_get_property(node, "autorepeat", NULL);
+       button = pdata->buttons;

-       i = 0;
        for_each_child_of_node(node, pp) {
                enum of_gpio_flags flags;

@@ -592,7 +594,10 @@ gpio_keys_get_devtree_pdata(struct device *dev)
                        continue;
                }

-               button = &pdata->buttons[i++];
+               if (!button) {
+                       error = -ENOMEM;
+                       goto err_free_pdata;
+               }

This tests impossible condition.

quoted

                button->gpio = of_get_gpio_flags(pp, 0, &flags);
                button->active_low = flags & OF_GPIO_ACTIVE_LOW;

@@ -614,6 +619,8 @@ gpio_keys_get_devtree_pdata(struct device *dev)
                if (of_property_read_u32(pp, "debounce-interval",
                                         &button->debounce_interval))
                        button->debounce_interval = 5;
+
+               button++;
        }

        if (pdata->nbuttons == 0) {
--

1.7.9.5

Tested-by: Alan M Butler <redacted>

I took the part initializing pdata->buttons and pdata->nbuttons and
folded it into the offending patch.

Thank you!

-- 
Dmitry