]> exis.tech > repos - linux.git/commit
gpio: mockup: reject invalid gpio_mockup_ranges widths
authorSamuel Moelius <sam.moelius@trailofbits.com>
Tue, 9 Jun 2026 00:45:38 +0000 (00:45 +0000)
committerBartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Tue, 9 Jun 2026 11:19:56 +0000 (13:19 +0200)
commit446e8c31d0fc7f1d92c06c2d2f7e7ed27f55f0c6
tree37d6a8410f1214db8279640beecb35aa423aaac8
parent6edb934de9bda3b7abcec856eaee6fc8b4278dd1
gpio: mockup: reject invalid gpio_mockup_ranges widths

gpio-mockup validates only that each second gpio_mockup_ranges value is
non-negative before creating the mock chips.  The fixed-base form uses
the second value as the first GPIO number after the range, while the
dynamic-base form uses it as the number of GPIOs.

gpio_mockup_register_chip() stores the resulting number of GPIOs in a
u16 and passes it through a PROPERTY_ENTRY_U16("nr-gpios", ...).  Values
greater than U16_MAX therefore truncate silently.  For example,
gpio_mockup_ranges=-1,65537 creates a one-line mock GPIO chip instead of
rejecting the invalid request.

Reject zero-width, reversed, and over-U16 ranges before registering any
mock chip.

Assisted-by: Codex:gpt-5.5-cyber-preview
Signed-off-by: Samuel Moelius <sam.moelius@trailofbits.com>
Link: https://patch.msgid.link/20260609004538.1240091.3fba33a20b88.gpio-mockup-ngpio-u16-truncation@trailofbits.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
drivers/gpio/gpio-mockup.c