Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1629103 > unrolled thread
| Started by | Pan Bian <bianpan2016@163.com> |
|---|---|
| First post | 2017-04-24 02:40 +0200 |
| Last post | 2017-04-24 09:20 +0200 |
| Articles | 2 — 2 participants |
Back to article view | Back to linux.kernel
[PATCH 1/1] power: Fix unchecked return value of devm_kzalloc Pan Bian <bianpan2016@163.com> - 2017-04-24 02:40 +0200
Re: [PATCH 1/1] power: Fix unchecked return value of devm_kzalloc Pali Rohár <pali.rohar@gmail.com> - 2017-04-24 09:20 +0200
| From | Pan Bian <bianpan2016@163.com> |
|---|---|
| Date | 2017-04-24 02:40 +0200 |
| Subject | [PATCH 1/1] power: Fix unchecked return value of devm_kzalloc |
| Message-ID | <tzAcN-7F3-11@gated-at.bofh.it> |
Function devm_kzalloc() will return a NULL pointer. However, in function isp1704_charger_probe(), the return value of devm_kzalloc() is directly used without validation. This may result in a bad memory access bug. Signed-off-by: Pan Bian <bianpan2016@163.com> --- drivers/power/supply/isp1704_charger.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/power/supply/isp1704_charger.c b/drivers/power/supply/isp1704_charger.c index 4cd6899..2f02463 100644 --- a/drivers/power/supply/isp1704_charger.c +++ b/drivers/power/supply/isp1704_charger.c @@ -418,6 +418,8 @@ static int isp1704_charger_probe(struct platform_device *pdev) pdata = devm_kzalloc(&pdev->dev, sizeof(struct isp1704_charger_data), GFP_KERNEL); + if (pdata) + goto fail0; pdata->enable_gpio = gpio; dev_info(&pdev->dev, "init gpio %d\n", pdata->enable_gpio); -- 1.9.1
[toc] | [next] | [standalone]
| From | Pali Rohár <pali.rohar@gmail.com> |
|---|---|
| Date | 2017-04-24 09:20 +0200 |
| Message-ID | <tzGrU-3YY-9@gated-at.bofh.it> |
| In reply to | #1629103 |
On Monday 24 April 2017 08:34:08 Pan Bian wrote: > Function devm_kzalloc() will return a NULL pointer. However, in function > isp1704_charger_probe(), the return value of devm_kzalloc() is directly > used without validation. This may result in a bad memory access bug. > > Signed-off-by: Pan Bian <bianpan2016@163.com> > --- > drivers/power/supply/isp1704_charger.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/drivers/power/supply/isp1704_charger.c b/drivers/power/supply/isp1704_charger.c > index 4cd6899..2f02463 100644 > --- a/drivers/power/supply/isp1704_charger.c > +++ b/drivers/power/supply/isp1704_charger.c > @@ -418,6 +418,8 @@ static int isp1704_charger_probe(struct platform_device *pdev) > > pdata = devm_kzalloc(&pdev->dev, > sizeof(struct isp1704_charger_data), GFP_KERNEL); > + if (pdata) > + goto fail0; > pdata->enable_gpio = gpio; > > dev_info(&pdev->dev, "init gpio %d\n", pdata->enable_gpio); fail0 returns ret value value which is initialized to -ENODEV. It could be fragile if somebody change default initialization ret value to something else (wort to 0). In your case before goto fail0 it is needed to explicitly set ret to -ENOMEM so prevent future problems. -- Pali Rohár pali.rohar@gmail.com
[toc] | [prev] | [standalone]
Back to top | Article view | linux.kernel
csiph-web