pinctrl: single: fix infinite loop caused by bad mask

commit 4e7e8017a80e1 (pinctrl: pinctrl-single:
enhance to configure multiple pins of different modules) improved
support for pinctrl-single,bits option, but also caused a regression
in parsing badly configured mask data.

If the masks in DT data are not quite right,
pcs_parse_bits_in_pinctrl_entry() can end up in an infinite loop,
trashing memory at the same time.

Add a check to verify that each loop actually removes bits from the
'mask', so that the loop can eventually end.

Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Acked-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>

diff --git a/drivers/pinctrl/pinctrl-single.c b/drivers/pinctrl/pinctrl-single.c
index 174f4c50cd77b7d63f59672906fa660e20972355..de6459628b4fe9af7d7838975bdc6a92de042bca 100644 (file)
--- a/drivers/pinctrl/pinctrl-single.c
+++ b/drivers/pinctrl/pinctrl-single.c
@@ -1318,6 +1318,14 @@ static int pcs_parse_bits_in_pinctrl_entry(struct pcs_device *pcs,
                        mask_pos = ((pcs->fmask) << (bit_pos - 1));
                        val_pos = val & mask_pos;
                        submask = mask & mask_pos;
+
+                       if ((mask & mask_pos) == 0) {
+                               dev_err(pcs->dev,
+                                       "Invalid mask for %s at 0x%x\n",
+                                       np->name, offset);
+                               break;
+                       }
+
                        mask &= ~mask_pos;
 
                        if (submask != mask_pos) {