[PATCH v2] gpio: line-mux: fix unsigned truncation of property count error
From: shao.mingyin
Date: Tue Nov 10 2026 - 10:02:23 EST
From: Shao Mingyin <shao.mingyin@xxxxxxxxxx>
device_property_count_u32() returns an int and reports errors with a
negative errno (e.g. -EINVAL when the "gpio-line-mux-states" property is
missing). Storing that into an unsigned int turns -EINVAL into a huge
value, so the "if (!ngpio)" guard never triggers and struct_size() then
computes a huge size. The allocation fails with -ENOMEM, hiding the
real error; struct_size() saturates on overflow, so this is not an
undersized allocation on 32-bit builds either.
Use a signed int for the count, propagate the property-array error, and
reject a zero count.
Fixes: 2b03d9a40cd1 ("gpio: add gpio-line-mux driver")
Signed-off-by: Shao Mingyin <shao.mingyin@xxxxxxxxxx>
Reviewed-by: Jonas Jelonek <jelonek.jonas@xxxxxxxxx>
---
This patch supersedes 5/5 of the v1 series; 1/5 has been withdrawn and
2/5-4/5 are unchanged.
v2:
- keep the declarations in reverse christmas tree order; merge
"int ngpio, ret" (Jonas Jelonek)
- propagate the property-array errno when ngpio < 0, and map only a
zero count to -EINVAL (Jonas Jelonek)
v1: https://lore.kernel.org/all/20261107161258203oCy-Pa4_0rNe65TqrzFWD@xxxxxxxxxx/
drivers/gpio/gpio-line-mux.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/gpio/gpio-line-mux.c b/drivers/gpio/gpio-line-mux.c
index b4452d956bf0271d25598de2117c0db73805aba6..00b69632c4401300d11bbc296306df114d18c08f 100644
--- a/drivers/gpio/gpio-line-mux.c
+++ b/drivers/gpio/gpio-line-mux.c
@@ -48,11 +48,12 @@ static int gpio_lmux_probe(struct platform_device *pdev)
{
struct device *dev = &pdev->dev;
struct gpio_lmux *glm;
- unsigned int ngpio;
size_t size;
- int ret;
+ int ngpio, ret;
ngpio = device_property_count_u32(dev, "gpio-line-mux-states");
+ if (ngpio < 0)
+ return ngpio;
if (!ngpio)
return -EINVAL;
--
2.27.0