2019-05-27 13:06:55

by Gen Zhang

[permalink] [raw]

Subject: [PATCH] tegra-hsp: fix a missing-check bug in tegra_hsp_doorbell_create()

---

In tegra_hsp_doorbell_create(), 'db->name' is allocated by
devm_kstrdup_const(). It returns NULL when fails. So 'db->name' should
be checked.

Signed-off-by: Gen Zhang <[email protected]>
---
diff --git a/drivers/mailbox/tegra-hsp.c b/drivers/mailbox/tegra-hsp.c
index 11fc9fd..b613c46 100644
--- a/drivers/mailbox/tegra-hsp.c
+++ b/drivers/mailbox/tegra-hsp.c
@@ -292,6 +292,8 @@ tegra_hsp_doorbell_create(struct tegra_hsp *hsp, const char *name,
db->channel.hsp = hsp;

db->name = devm_kstrdup_const(hsp->dev, name, GFP_KERNEL);
+ if (!db->name)
+ return ERR_PTR(-ENOMEM);
db->master = master;
db->index = index;

---

2019-05-27 14:08:46

by Thierry Reding

[permalink] [raw]

Subject: Re: [PATCH] tegra-hsp: fix a missing-check bug in tegra_hsp_doorbell_create()

---

On Mon, May 27, 2019 at 09:04:30PM +0800, Gen Zhang wrote:
> In tegra_hsp_doorbell_create(), 'db->name' is allocated by
> devm_kstrdup_const(). It returns NULL when fails. So 'db->name' should
> be checked.
>
> Signed-off-by: Gen Zhang <[email protected]>
> ---
> diff --git a/drivers/mailbox/tegra-hsp.c b/drivers/mailbox/tegra-hsp.c
> index 11fc9fd..b613c46 100644
> --- a/drivers/mailbox/tegra-hsp.c
> +++ b/drivers/mailbox/tegra-hsp.c
> @@ -292,6 +292,8 @@ tegra_hsp_doorbell_create(struct tegra_hsp *hsp, const char *name,
> db->channel.hsp = hsp;
>
> db->name = devm_kstrdup_const(hsp->dev, name, GFP_KERNEL);
> + if (!db->name)
> + return ERR_PTR(-ENOMEM);

I don't think this could ever happen, since name is always from .rodata
and hence devm_kstrdup_const() never returns NULL. But formally this is
correct, so:

Acked-by: Thierry Reding <[email protected]>

---

Attachments:

(No filename) (908.00 B)
signature.asc (849.00 B)
Download all attachments

2019-05-27 14:12:42

by Gen Zhang

[permalink] [raw]

Subject: Re: [PATCH] tegra-hsp: fix a missing-check bug in tegra_hsp_doorbell_create()

---

On Mon, May 27, 2019 at 04:05:49PM +0200, Thierry Reding wrote:
> On Mon, May 27, 2019 at 09:04:30PM +0800, Gen Zhang wrote:
> > In tegra_hsp_doorbell_create(), 'db->name' is allocated by
> > devm_kstrdup_const(). It returns NULL when fails. So 'db->name' should
> > be checked.
> >
> > Signed-off-by: Gen Zhang <[email protected]>
> > ---
> > diff --git a/drivers/mailbox/tegra-hsp.c b/drivers/mailbox/tegra-hsp.c
> > index 11fc9fd..b613c46 100644
> > --- a/drivers/mailbox/tegra-hsp.c
> > +++ b/drivers/mailbox/tegra-hsp.c
> > @@ -292,6 +292,8 @@ tegra_hsp_doorbell_create(struct tegra_hsp *hsp, const char *name,
> > db->channel.hsp = hsp;
> >
> > db->name = devm_kstrdup_const(hsp->dev, name, GFP_KERNEL);
> > + if (!db->name)
> > + return ERR_PTR(-ENOMEM);
>
> I don't think this could ever happen, since name is always from .rodata
> and hence devm_kstrdup_const() never returns NULL. But formally this is
> correct, so:
>
> Acked-by: Thierry Reding <[email protected]>
Thanks for your reply, Thierry.

Thanks
Gen