Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1162449AbaDCHWE (ORCPT ); Thu, 3 Apr 2014 03:22:04 -0400 Received: from userp1040.oracle.com ([156.151.31.81]:17457 "EHLO userp1040.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1162380AbaDCHV7 (ORCPT ); Thu, 3 Apr 2014 03:21:59 -0400 Date: Thu, 3 Apr 2014 10:21:34 +0300 From: Dan Carpenter To: Thomas Gleixner , Sricharan R Cc: Grant Likely , Rob Herring , linux-kernel@vger.kernel.org, devicetree@vger.kernel.org, kernel-janitors@vger.kernel.org Subject: [patch] irqchip/irq-crossbar: not allocating enough memory Message-ID: <20140403072134.GA14286@mwanda> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.5.21 (2010-09-15) X-Source-IP: ucsinet21.oracle.com [156.151.31.93] Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org We are allocating the size of a pointer and not the size of the data. This will lead to memory corruption. There isn't actually a "cb_device" struct, btw. The code is only able to compile because GCC knows that all pointers are the same size. Fixes: 96ca848ef7ea ('DRIVERS: IRQCHIP: CROSSBAR: Add support for Crossbar IP') Signed-off-by: Dan Carpenter diff --git a/drivers/irqchip/irq-crossbar.c b/drivers/irqchip/irq-crossbar.c index fc817d2..3d15d16 100644 --- a/drivers/irqchip/irq-crossbar.c +++ b/drivers/irqchip/irq-crossbar.c @@ -107,7 +107,7 @@ static int __init crossbar_of_init(struct device_node *node) int i, size, max, reserved = 0, entry; const __be32 *irqsr; - cb = kzalloc(sizeof(struct cb_device *), GFP_KERNEL); + cb = kzalloc(sizeof(*cb), GFP_KERNEL); if (!cb) return -ENOMEM; -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/