2015-12-14 14:16:30

by Nicholas Mc Guire

Subject: [PATCH] clk: unchecked return of kmalloc_array

kmalloc_array return is unchecked - given how parent_names is being treated
in case of allocation error it probably is ok to treat clock->parents the
same way and simply return.

problem was located with coccinelle

Signed-off-by: Nicholas Mc Guire <[email protected]>
---

patch was compile tested for shmobile_defconfig
(implies CONFIG_ARCH_SHMOBILE_MULTI=y)

patch is against linux-next (localversion-next -next-20151214)

drivers/clk/shmobile/clk-div6.c | 2 ++
1 file changed, 2 insertions(+)

diff --git a/drivers/clk/shmobile/clk-div6.c b/drivers/clk/shmobile/clk-div6.c
index b4c8d67..e6b7533 100644
--- a/drivers/clk/shmobile/clk-div6.c
+++ b/drivers/clk/shmobile/clk-div6.c
@@ -196,6 +196,8 @@ static void __init cpg_div6_clock_init(struct device_node *np)

clock->parents = kmalloc_array(num_parents, sizeof(*clock->parents),
GFP_KERNEL);
+ if (!clock->parents)
+ return;
parent_names = kmalloc_array(num_parents, sizeof(*parent_names),
GFP_KERNEL);
if (!parent_names)
--
1.7.10.4

2015-12-14 14:06:42

by Nicholas Mc Guire

Subject: Re: [PATCH] clk: unchecked return of kmalloc_array

On Mon, Dec 14, 2015 at 02:16:55PM +0100, Nicholas Mc Guire wrote:
> kmalloc_array return is unchecked - given how parent_names is being treated
> in case of allocation error it probably is ok to treat clock->parents the
> same way and simply return.
>
> problem was located with coccinelle
>
> Signed-off-by: Nicholas Mc Guire <[email protected]>
> ---
>
> patch was compile tested for shmobile_defconfig
> (implies CONFIG_ARCH_SHMOBILE_MULTI=y)
>
> patch is against linux-next (localversion-next -next-20151214)
>
> drivers/clk/shmobile/clk-div6.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/drivers/clk/shmobile/clk-div6.c b/drivers/clk/shmobile/clk-div6.c
> index b4c8d67..e6b7533 100644
> --- a/drivers/clk/shmobile/clk-div6.c
> +++ b/drivers/clk/shmobile/clk-div6.c
> @@ -196,6 +196,8 @@ static void __init cpg_div6_clock_init(struct device_node *np)
>
> clock->parents = kmalloc_array(num_parents, sizeof(*clock->parents),
> GFP_KERNEL);
> + if (!clock->parents)
> + return;
> parent_names = kmalloc_array(num_parents, sizeof(*parent_names),
>

giving the callchain of kmalloc_array a look I guess there should be
some memset for parent_names and clock->parents - or is there a reason why
no memset would be needed here ?

thx!
hofrat