gpio: mvebu: fix potential user-after-free on probe

[ Upstream commit 7ee1a01e47403f72b9f38839a737692f6991263e ]

When mvebu_pwm_probe() fails IRQ domain is not released. Move pwm probe
before IRQ domain allocation. Add pwm cleanup code to the failure path.

Fixes: 757642f9a584 ("gpio: mvebu: Add limited PWM support")
Reported-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/gpio/gpio-mvebu.c b/drivers/gpio/gpio-mvebu.c
index adc768f908f1ae1937f3d245088c590b449e574f..3b78dcda47364e47e7280dc6ae66080636a51879 100644 (file)
--- a/drivers/gpio/gpio-mvebu.c
+++ b/drivers/gpio/gpio-mvebu.c
@@ -1191,6 +1191,13 @@ static int mvebu_gpio_probe(struct platform_device *pdev)
 
        devm_gpiochip_add_data(&pdev->dev, &mvchip->chip, mvchip);
 
+       /* Some MVEBU SoCs have simple PWM support for GPIO lines */
+       if (IS_ENABLED(CONFIG_PWM)) {
+               err = mvebu_pwm_probe(pdev, mvchip, id);
+               if (err)
+                       return err;
+       }
+
        /* Some gpio controllers do not provide irq support */
        if (!have_irqs)
                return 0;
@@ -1200,7 +1207,8 @@ static int mvebu_gpio_probe(struct platform_device *pdev)
        if (!mvchip->domain) {
                dev_err(&pdev->dev, "couldn't allocate irq domain %s (DT).\n",
                        mvchip->chip.label);
-               return -ENODEV;
+               err = -ENODEV;
+               goto err_pwm;
        }
 
        err = irq_alloc_domain_generic_chips(
@@ -1248,14 +1256,12 @@ static int mvebu_gpio_probe(struct platform_device *pdev)
                                                 mvchip);
        }
 
-       /* Some MVEBU SoCs have simple PWM support for GPIO lines */
-       if (IS_ENABLED(CONFIG_PWM))
-               return mvebu_pwm_probe(pdev, mvchip, id);
-
        return 0;
 
 err_domain:
        irq_domain_remove(mvchip->domain);
+err_pwm:
+       pwmchip_remove(&mvchip->mvpwm->chip);
 
        return err;
 }