[PATCH 5/5] gpio: line-mux: fix unsigned truncation of property count error

[shao.mingyin]

From: Shao Mingyin <shao.mingyin@xxxxxxxxxx>

device_property_count_u32() returns an int and reports errors with a
negative errno (e.g. -EINVAL when the "gpio-line-mux-states" property is
missing).  Storing that into an unsigned int turns -EINVAL into a huge
value, so the "if (!ngpio)" guard never triggers and struct_size() then
computes a huge size.  The allocation fails with -ENOMEM, hiding the
real error; struct_size() saturates on overflow, so this is not an
undersized allocation on 32-bit builds either.

Use a signed int for the count and reject non-positive values.

Fixes: 2b03d9a40cd1 ("gpio: add gpio-line-mux driver")
Signed-off-by: Shao Mingyin <shao.mingyin@xxxxxxxxxx>
---
 drivers/gpio/gpio-line-mux.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpio/gpio-line-mux.c b/drivers/gpio/gpio-line-mux.c
index b4452d956b..19e4212de2 100644
--- a/drivers/gpio/gpio-line-mux.c
+++ b/drivers/gpio/gpio-line-mux.c
@@ -48,12 +48,12 @@
 {
 	struct device *dev = &pdev->dev;
 	struct gpio_lmux *glm;
-	unsigned int ngpio;
+	int ngpio;
 	size_t size;
 	int ret;
 
 	ngpio = device_property_count_u32(dev, "gpio-line-mux-states");
-	if (!ngpio)
+	if (ngpio <= 0)
 		return -EINVAL;
 
 	size = struct_size(glm, gpio_mux_states, ngpio);