Re: [PATCH 5/5] gpio: line-mux: fix unsigned truncation of property count error

[Jonas Jelonek]

Hi Shao,

On 07.11.26 09:12, shao.mingyin@xxxxxxxxxx wrote:
> From: Shao Mingyin <shao.mingyin@xxxxxxxxxx>
>
> device_property_count_u32() returns an int and reports errors with a
> negative errno (e.g. -EINVAL when the "gpio-line-mux-states" property is
> missing).  Storing that into an unsigned int turns -EINVAL into a huge
> value, so the "if (!ngpio)" guard never triggers and struct_size() then
> computes a huge size.  The allocation fails with -ENOMEM, hiding the
> real error; struct_size() saturates on overflow, so this is not an
> undersized allocation on 32-bit builds either.
>
> Use a signed int for the count and reject non-positive values.
>
> Fixes: 2b03d9a40cd1 ("gpio: add gpio-line-mux driver")
> Signed-off-by: Shao Mingyin <shao.mingyin@xxxxxxxxxx>
> ---
>  drivers/gpio/gpio-line-mux.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/gpio/gpio-line-mux.c b/drivers/gpio/gpio-line-mux.c
> index b4452d956b..19e4212de2 100644
> --- a/drivers/gpio/gpio-line-mux.c
> +++ b/drivers/gpio/gpio-line-mux.c
> @@ -48,12 +48,12 @@
>  {
>  	struct device *dev = &pdev->dev;
>  	struct gpio_lmux *glm;
> -	unsigned int ngpio;
> +	int ngpio;
>  	size_t size;
>  	int ret;
>  

Nit: Please adjust to keep reverse christmas tree. I think 'int ret' and
'int ngpio' can be merged too.

>  	ngpio = device_property_count_u32(dev, "gpio-line-mux-states");
> -	if (!ngpio)
> +	if (ngpio <= 0)
>  		return -EINVAL;
>  
>  	size = struct_size(glm, gpio_mux_states, ngpio);

Maybe return the error if < 0, instead of -EINVAL for all?

With those addressed, you can add:

Reviewed-by: Jonas Jelonek <jelonek.jonas@xxxxxxxxx>

Best,
Jonas