summaryrefslogtreecommitdiff
path: root/drivers
diff options
context:
space:
mode:
authorMichael Stickel <ms@mycable.de>2014-05-26 10:03:16 +0200
committerLinus Walleij <linus.walleij@linaro.org>2014-05-27 15:50:57 +0200
commit3e3bed913e8bbd78f38cefd5d575475f45c05dd0 (patch)
tree875487e1e3fae9917c72b375456019e118a9b82a /drivers
parent821e85f2a8433614b84cea194ac4f1302ef47ec9 (diff)
gpio: mcp23s08: fixed count variable for devicetree probing
Fixed missing increase of count variable for devicetree path in driver probing. The gpio-mcp23s08 driver has two paths for getting the platform registration information. One for the classic platform initialization and one for openfirmware devicetree based initialization. The devicetree based path is missing the increase of the count variable, which results in the count variable to become negative in the later use, where it is decreased. The count variable is used as an index into a vector. This results in accessing invalid memory space and can result in an exception. Tested this with an AM3352 SoC with two mcp23s17 on two chip selects as well as on a shared chip select. Signed-off-by: Michael Stickel <ms@mycable.de> Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Diffstat (limited to 'drivers')
-rw-r--r--drivers/gpio/gpio-mcp23s08.c11
1 files changed, 10 insertions, 1 deletions
diff --git a/drivers/gpio/gpio-mcp23s08.c b/drivers/gpio/gpio-mcp23s08.c
index d7f384f9cde0..00fbb30b9b10 100644
--- a/drivers/gpio/gpio-mcp23s08.c
+++ b/drivers/gpio/gpio-mcp23s08.c
@@ -895,8 +895,13 @@ static int mcp23s08_probe(struct spi_device *spi)
return -ENODEV;
}
- for (addr = 0; addr < ARRAY_SIZE(pdata->chip); addr++)
+ for (addr = 0; addr < ARRAY_SIZE(pdata->chip); addr++) {
pullups[addr] = 0;
+ if (spi_present_mask & (1 << addr))
+ chips++;
+ }
+ if (!chips)
+ return -ENODEV;
} else {
type = spi_get_device_id(spi)->driver_data;
pdata = dev_get_platdata(&spi->dev);
@@ -935,6 +940,10 @@ static int mcp23s08_probe(struct spi_device *spi)
if (!(spi_present_mask & (1 << addr)))
continue;
chips--;
+ if (chips < 0) {
+ dev_err(&spi->dev, "FATAL: invalid negative chip id\n");
+ goto fail;
+ }
data->mcp[addr] = &data->chip[chips];
status = mcp23s08_probe_one(data->mcp[addr], &spi->dev, spi,
0x40 | (addr << 1), type, base,