linux-kernel-test/drivers
David Brownell 978ccaa8ea gpiolib: fix oops in gpio_get_value_cansleep()
We can get the following oops from gpio_get_value_cansleep() when a GPIO
controller doesn't provide a get() callback:

 Unable to handle kernel paging request for instruction fetch
 Faulting instruction address: 0x00000000
 Oops: Kernel access of bad area, sig: 11 [#1]
 [...]
 NIP [00000000] 0x0
 LR [c0182fb0] gpio_get_value_cansleep+0x40/0x50
 Call Trace:
 [c7b79e80] [c0183f28] gpio_value_show+0x5c/0x94
 [c7b79ea0] [c01a584c] dev_attr_show+0x30/0x7c
 [c7b79eb0] [c00d6b48] fill_read_buffer+0x68/0xe0
 [c7b79ed0] [c00d6c54] sysfs_read_file+0x94/0xbc
 [c7b79ef0] [c008f24c] vfs_read+0xb4/0x16c
 [c7b79f10] [c008f580] sys_read+0x4c/0x90
 [c7b79f40] [c0013a14] ret_from_syscall+0x0/0x38

It's OK to request the value of *any* GPIO; most GPIOs are bidirectional,
so configuring them as outputs just enables an output driver and doesn't
disable the input logic.

So the problem is that gpio_get_value_cansleep() isn't making the same
sanity check that gpio_get_value() does: making sure this GPIO isn't one
of the atypical "no input logic" cases.

Reported-by: Anton Vorontsov <avorontsov@ru.mvista.com>
Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
Cc: <stable@kernel.org>		[2.6.27.x, 2.6.26.x, 2.6.25.x]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2008-10-20 08:52:36 -07:00
..
accessibility
acpi
amba
ata
atm
auxdisplay
base memory_probe: fix wrong sysfs file attribute 2008-10-20 08:52:32 -07:00
block ub: remove sg_stat 2008-10-17 14:40:52 -07:00
bluetooth
cdrom
char Char: sx, remove bogus iomap 2008-10-20 08:52:36 -07:00
clocksource
connector
cpufreq
cpuidle
crypto
dca
dio
dma
edac
eisa
firewire
firmware
gpio gpiolib: fix oops in gpio_get_value_cansleep() 2008-10-20 08:52:36 -07:00
gpu drm/i915: fix ioremap of a user address for non-root (CVE-2008-3831) 2008-10-18 07:18:05 +10:00
hid USB: remove warn macro from HID core 2008-10-17 14:41:09 -07:00
hwmon hwmon: applesmc: lighter wait mechanism, drastic improvement 2008-10-20 08:52:35 -07:00
i2c hwmon: (ams) Convert to a new-style i2c driver 2008-10-17 17:51:12 +02:00
ide
ieee1394
infiniband Merge git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-misc-2.6 2008-10-17 09:00:23 -07:00
input USB: remove info() macro from usb input drivers 2008-10-17 14:41:10 -07:00
isdn
leds
lguest
macintosh
mca
md Merge git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-misc-2.6 2008-10-17 09:00:23 -07:00
media Merge git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6 2008-10-17 15:43:52 -07:00
memstick
message
mfd
misc HP-WMI: additional keycode (or typo) 2008-10-20 08:52:34 -07:00
mmc
mtd USB: remove info() macro from usb mtd drivers 2008-10-17 14:41:10 -07:00
net USB: remove info() macro from usb network drivers 2008-10-17 14:41:10 -07:00
nubus
of
oprofile
parisc
parport
pci intel-iommu: typo fix and correct word in the comment 2008-10-20 08:52:34 -07:00
pcmcia
pnp
power
ps3
rapidio
regulator
rtc rtc-cmos: export second NVRAM bank 2008-10-20 08:52:36 -07:00
s390 Merge branch 'for-linus' of git://git.kernel.dk/linux-2.6-block 2008-10-17 09:29:55 -07:00
sbus
scsi Merge git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-misc-2.6 2008-10-17 09:00:23 -07:00
serial Altix serial: fix 2008-10-20 08:52:36 -07:00
sh
sn
spi
ssb
staging
tc
telephony
thermal
uio
usb USB: remove err() macro from more usb drivers 2008-10-17 14:41:14 -07:00
video
virtio
w1
watchdog
xen
zorro
Kconfig
Makefile