From nobody Sat Jul 25 03:46:49 2026 Received: from mail-wm1-f43.google.com (mail-wm1-f43.google.com [209.85.128.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 82855392C4C for ; Sun, 19 Jul 2026 12:11:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.43 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784463114; cv=none; b=klSyoStz2GtAsjPkqzxVEXe/Y8+ctH6orDG8Nri69bjSW6dgIa30mybIAcJOxWPGXORK1eXEAkQc1QFDiyydiWMLnKOcRaALJiR6Pt1KO2YIMJYorKowPl2kUNTCCbA6LdET4SFz4QQMvv/nY5xlc+HedwmZ6EMI7DKOwu3X0Qk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784463114; c=relaxed/simple; bh=5VMovNs5r6OHs/wcX2aDD1qfvLwXJxRv8Jf5x/+peMc=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=kqr5RuV9fqAF158z+tGaHcXD4qrYNSl1UiJ/AyZKXfsQlNx0GzKKHFlo+0vaROdaI7SCrBg81kAF5H1FcK//JNwiuzEt9aG/NgRBsYRLd45b0mOxKtl/u6ZLfAhJbo4GJvIRm9xeOmtKJ0ejF3OEV+5lOENoeHQLHtQ1/7iNG9w= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=OTk6X1rN; arc=none smtp.client-ip=209.85.128.43 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="OTk6X1rN" Received: by mail-wm1-f43.google.com with SMTP id 5b1f17b1804b1-4955aa106b1so2560055e9.0 for ; Sun, 19 Jul 2026 05:11:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784463111; x=1785067911; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=DogqYPGisrMHm1D/3xJuw8fk3DrWTbuaVsByeLIrnm8=; b=OTk6X1rNgNDGEnrF/sXouhIGXU/re7R5PHMbQtY/Jh7jRGNa0DJRMLjrlT54GwCXLO 1PfDb8ZUJ0X0mpjhv+t6ox36jK63loZ6L64vOyriJ5qlbjXq7PjqMy4/kwDN+z6/UkVB D0jfJcICYiLi9Xcj6go6pkyHp2HI3pqniDvtBa1XC4iwCBMbn7B1GgbK9LGsbyfCTHTw mWO3AO4DYnmVXhWbMPsUym9Z2QcCV17+qsiDfpuKvIc2ByH0OqS1jgXyL2CfIEz1yQnK OEWVkDBJK4YV2cqL75RLUX+cOwfQE1jYpxMZSPz8Xs9cboLfKUQpbtPOXhjxslJAq0Cf RThw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784463111; x=1785067911; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=DogqYPGisrMHm1D/3xJuw8fk3DrWTbuaVsByeLIrnm8=; b=fgc1U7gJZU0LXgr2jUNTH8oB8/szqTMdsJpgoZ67Xn1TjteWtSAzrR/Pscz6q/DQWp d9p/raJSheyMLzD69Qw9B5fK19ZjR5SO02lpROCHmDVRN14u49TwUJE8VjufZzGFU4lG lz2mw7TO5AOpX+ThBr1TBCeW3a1+wZba1S2JJdmcYctqOw17d0iNF0XmtZJCdlRDr4VE DoWClzBuFsuIx9o+dloez0D2OW03jb4iJcGI8EnYqO1km3XZ/mJXBsRa2UjwimCPm5/n sslEcmr1JEafBg95arnTtCZxB4xqp7QkjP37CNewaA1Xip4avjo8WsXnAEeNPYDqhyyk Zgqg== X-Forwarded-Encrypted: i=1; AHgh+Rr1hFQG25fAf78dwE+liK8zGu9SHHiqacBDwJqWVfZMTQNM2ZQPPkCnvrBNzXKvpTK5A3WqRNagorRPwGg=@vger.kernel.org X-Gm-Message-State: AOJu0Yzf5v+odjE1mXGfXtHoabifHL6wqz2tY/yrVgq04AsWTFM2znWZ egYCFm3ZXWYGJpcrgwaAafndhLPhtZDphcZZTpFAfoLIIad+hI16KnOd X-Gm-Gg: AfdE7cn+X6doDVT38haOglTVK37fN/exi/52xPGekbmXB+Zfj/myUU6R4fn4TE3r8ob HJhLzs2dmQ7MOEv8KJwf8XMO2+9LKV93ncFGst15+iXVeGFnBNDRHqcfflkvNBMmMD/nlwWbnH8 DquqAhnhezkeuXE3WIoMQid9D+hoChiuK7WrFaEU/IVeyxm4czHdcV54VhBGouPTELcJoQKsYZs hCuOk6PZv0sOfyTte3i/ZWp84YnP4uN4L8zeufbI/K5TXEysfAz5QBVkCl5Gzoxqe2qzABolVqM 65T+Zn2sSKyU0eywZa/9GNSK5bEOc4IN03ZefApQai6cVDH4jerkfxCjfL2Gm07myyQ3l/B3kCX J0mxDlLnNfTsF3cXWuxeMWKAltwfHv9mcQmsolB0U+2DUZmXhrWyzCdtbtbYQW0Vujq3CK67jtR vaa5Ivou4VkDuITHbKmgsJis4lgWrRrm/+e+QaUGIZ/wZGr8ehcVSfETpruTUDDpOhQdnL4ng1J Pdm3yKYz5FTlZmTmFsSHPUAgIT+9aMl5xAXKnRchcYGhGCLovqTg0q8Q9A9FY06eoON7Jgr4pd1 S0NdhFV/1A== X-Received: by 2002:a05:600c:1382:b0:495:699:5c8b with SMTP id 5b1f17b1804b1-4954a3e206dmr104802035e9.7.1784463110404; Sun, 19 Jul 2026 05:11:50 -0700 (PDT) Received: from localhost.localdomain (dynamic-2a02-3100-aeaf-bd01-78a0-2a2d-507f-c97c.310.pool.telefonica.de. [2a02:3100:aeaf:bd01:78a0:2a2d:507f:c97c]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-47f63ed1911sm21750744f8f.22.2026.07.19.05.11.49 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Sun, 19 Jul 2026 05:11:49 -0700 (PDT) From: Karl Mehltretter To: Linus Walleij Cc: Karl Mehltretter , Will Deacon , linux-gpio@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH] pinctrl: devicetree: don't free uninitialized dev_name on error path Date: Sun, 19 Jul 2026 14:11:40 +0200 Message-Id: <20260719121140.28730-1-kmehltretter@gmail.com> X-Mailer: git-send-email 2.39.5 (Apple Git-154) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" dt_remember_or_free_map() duplicates dev_name for each map entry. If kstrdup_const() fails, dt_free_map() frees dev_name in all num_maps entries, including entries that have not been initialized. Some pinctrl drivers, including pinctrl-imx, allocate the map with kmalloc() and leave dev_name for the core to initialize. The untouched entries therefore contain uninitialized data which is passed to kfree_const(). Reproduced on qemu's mcimx6ul-evk (pinctrl-imx) with failslab injection while binding the pinctrl-consuming device, under KASAN: BUG: KASAN: double-free in dt_free_map+0x34/0xa4 Free of addr c425a900 by task init/1 kfree from dt_free_map+0x34/0xa4 dt_free_map from dt_remember_or_free_map+0x184/0x198 dt_remember_or_free_map from pinctrl_dt_to_map+0x33c/0x4c8 pinctrl_dt_to_map from create_pinctrl+0x9c/0x5c0 Initialize all dev_name fields to NULL before duplicating the device name, making the full-map cleanup safe after a partial failure. Fixes: be4c60b563ed ("pinctrl: devicetree: Avoid taking direct reference to= device name string") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-fable-5 Signed-off-by: Karl Mehltretter --- drivers/pinctrl/devicetree.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/pinctrl/devicetree.c b/drivers/pinctrl/devicetree.c index 02a271dd292f..465b43092eb7 100644 --- a/drivers/pinctrl/devicetree.c +++ b/drivers/pinctrl/devicetree.c @@ -69,6 +69,10 @@ static int dt_remember_or_free_map(struct pinctrl *p, co= nst char *statename, int i; struct pinctrl_dt_map *dt_map; =20 + /* Initialize dev_name before any allocation can fail */ + for (i =3D 0; i < num_maps; i++) + map[i].dev_name =3D NULL; + /* Initialize common mapping table entry fields */ for (i =3D 0; i < num_maps; i++) { const char *devname; --=20 2.53.0