gpiolib: sanitize the return value of gpio_chip::request()

The return value of the request() callback may be propagated to
user-space. If a bad driver returns a positive number, it may confuse
user programs. Tighten the API contract and check for positive numbers
returned by GPIO controllers.

Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Link: https://lore.kernel.org/r/20250210-gpio-sanitize-retvals-v1-2-12ea88506cb2@linaro.org
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>

diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index fea0cdec0b267cca15da00bf9b2858b6282b401c..a98025b0ecf738f53a621160d2555c885238bc4f 100644 (file)
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -2349,6 +2349,8 @@ static int gpiod_request_commit(struct gpio_desc *desc, const char *label)
                        ret = guard.gc->request(guard.gc, offset);
                else
                        ret = -EINVAL;
+               if (ret > 0)
+                       ret = -EBADE;
                if (ret)
                        goto out_clear_bit;
        }

diff --git a/include/linux/gpio/driver.h b/include/linux/gpio/driver.h
index 10544f4a03e5e43f978af7b703a49b19fe299227..ce22c072337c4280f5f44920300529d4d18c1068 100644 (file)
--- a/include/linux/gpio/driver.h
+++ b/include/linux/gpio/driver.h
@@ -329,7 +329,8 @@ struct gpio_irq_chip {
  * @fwnode: optional fwnode providing this controller's properties
  * @owner: helps prevent removal of modules exporting active GPIOs
  * @request: optional hook for chip-specific activation, such as
- *     enabling module power and clock; may sleep
+ *     enabling module power and clock; may sleep; must return 0 on success
+ *     or negative error number on failure
  * @free: optional hook for chip-specific deactivation, such as
  *     disabling module power and clock; may sleep
  * @get_direction: returns direction for signal "offset", 0=out, 1=in,