gpio: mvebu: fix potential user-after-free on probe

When mvebu_pwm_probe() fails IRQ domain is not released. Move pwm probe
before IRQ domain allocation. Add pwm cleanup code to the failure path.

Fixes: 757642f9a584 ("gpio: mvebu: Add limited PWM support")
Reported-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>

diff --git a/drivers/gpio/gpio-mvebu.c b/drivers/gpio/gpio-mvebu.c
index 433e2c3f3fd5d1dd20d8955d8db198775216052d..2f245594a90a600c3e96ccf613e48c7088ef5985 100644 (file)
--- a/drivers/gpio/gpio-mvebu.c
+++ b/drivers/gpio/gpio-mvebu.c
@@ -1197,6 +1197,13 @@ static int mvebu_gpio_probe(struct platform_device *pdev)
 
        devm_gpiochip_add_data(&pdev->dev, &mvchip->chip, mvchip);
 
+       /* Some MVEBU SoCs have simple PWM support for GPIO lines */
+       if (IS_ENABLED(CONFIG_PWM)) {
+               err = mvebu_pwm_probe(pdev, mvchip, id);
+               if (err)
+                       return err;
+       }
+
        /* Some gpio controllers do not provide irq support */
        if (!have_irqs)
                return 0;
@@ -1206,7 +1213,8 @@ static int mvebu_gpio_probe(struct platform_device *pdev)
        if (!mvchip->domain) {
                dev_err(&pdev->dev, "couldn't allocate irq domain %s (DT).\n",
                        mvchip->chip.label);
-               return -ENODEV;
+               err = -ENODEV;
+               goto err_pwm;
        }
 
        err = irq_alloc_domain_generic_chips(
@@ -1254,14 +1262,12 @@ static int mvebu_gpio_probe(struct platform_device *pdev)
                                                 mvchip);
        }
 
-       /* Some MVEBU SoCs have simple PWM support for GPIO lines */
-       if (IS_ENABLED(CONFIG_PWM))
-               return mvebu_pwm_probe(pdev, mvchip, id);
-
        return 0;
 
 err_domain:
        irq_domain_remove(mvchip->domain);
+err_pwm:
+       pwmchip_remove(&mvchip->mvpwm->chip);
 
        return err;
 }