2024-04-09 11:14:51

by Ma Ke

Subject: [PATCH] pinctrl: apple-gpio: Fix null pointer dereference in apple_gpio_pinctrl_probe()

devm_kasprintf() returns a pointer to dynamically allocated memory which
can be NULL upon failure. We add a check to ensure that failure does not
occur.

Signed-off-by: Ma Ke <[email protected]>
---
drivers/pinctrl/pinctrl-apple-gpio.c | 2 ++
1 file changed, 2 insertions(+)

diff --git a/drivers/pinctrl/pinctrl-apple-gpio.c b/drivers/pinctrl/pinctrl-apple-gpio.c
index 3751c7de37aa..af2f90d1950f 100644
--- a/drivers/pinctrl/pinctrl-apple-gpio.c
+++ b/drivers/pinctrl/pinctrl-apple-gpio.c
@@ -474,6 +474,8 @@ static int apple_gpio_pinctrl_probe(struct platform_device *pdev)
for (i = 0; i < npins; i++) {
pins[i].number = i;
pins[i].name = devm_kasprintf(&pdev->dev, GFP_KERNEL, "PIN%u", i);
+ if (!pins[i].name)
+ return -ENOMEM;
pins[i].drv_data = pctl;
pin_names[i] = pins[i].name;
pin_nums[i] = i;
--
2.37.2

2024-04-09 11:53:36

by Krzysztof Kozlowski

Subject: Re: [PATCH] pinctrl: apple-gpio: Fix null pointer dereference in apple_gpio_pinctrl_probe()

On 09/04/2024 13:02, Ma Ke wrote:
> devm_kasprintf() returns a pointer to dynamically allocated memory which
> can be NULL upon failure. We add a check to ensure that failure does not
> occur.
>

Subject: I doubt that there is null pointer dereference... Don't just
copy existing commit msgs or subjects without adjusting to real case.

> Signed-off-by: Ma Ke <[email protected]>
> ---
> drivers/pinctrl/pinctrl-apple-gpio.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/drivers/pinctrl/pinctrl-apple-gpio.c b/drivers/pinctrl/pinctrl-apple-gpio.c
> index 3751c7de37aa..af2f90d1950f 100644
> --- a/drivers/pinctrl/pinctrl-apple-gpio.c
> +++ b/drivers/pinctrl/pinctrl-apple-gpio.c
> @@ -474,6 +474,8 @@ static int apple_gpio_pinctrl_probe(struct platform_device *pdev)
> for (i = 0; i < npins; i++) {
> pins[i].number = i;
> pins[i].name = devm_kasprintf(&pdev->dev, GFP_KERNEL, "PIN%u", i);
> + if (!pins[i].name)
> + return -ENOMEM;
> pins[i].drv_data = pctl;

The check is a bit later, so please be more precise how do you fix it
and how did you reproduced it.

Maybe checking earlier is reasonable, maybe is redundant. You did not
address it...

Best regards,
Krzysztof