Date:   Sun, 26 Feb 2023 16:33:47 +0100
From:   Simon Horman <simon.horman@corigine.com>
To:     Kang Chen <void0red@gmail.com>
Cc:     krzysztof.kozlowski@linaro.org, netdev@vger.kernel.org,
        linux-kernel@vger.kernel.org
Subject: Re: [PATCH] nfc: fdp: add null check of devm_kmalloc_array in
 fdp_nci_i2c_read_device_properties
Message-ID: <Y/t729AIYjxuP6X6@corigine.com>
References: <20230226095933.3286710-1-void0red@gmail.com>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20230226095933.3286710-1-void0red@gmail.com>
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?QAVCO1jc1C8ge0q34cuJUQu8gPFMFmvaUdrSaMs11pKKwzEbR+nIygr34Vn7?=
 =?us-ascii?Q?2TwkjAsXJVeyVsu6qmR+gU5c/mqdXs6MgPsF2ya03lEPRhPUroWEVeFaEnJx?=
 =?us-ascii?Q?GRQKYrKokIHuaBRC9Tl4/yXlp863kRqLF/mxfUuZ0IR5mTWaSq6koT3gBv0V?=
 =?us-ascii?Q?9e4pvlzqMhgKfFM13ohenkr470E0wDMv/qrLr83oB/kIZArLaP4zWR9XS2Tz?=
 =?us-ascii?Q?MOhBlUWJTUN1fgHJixaUvlEZ53GOkBw+5W+apE8iWPMCxjCk8LGmxRKls+vf?=
 =?us-ascii?Q?SHZp3wZ8JDYJkzPZ+BiF/C6+SIPEnLxQJuwGsrRQbJ+GQ4xlfBDKVmhCl0Pn?=
 =?us-ascii?Q?HS0J8NhnCEZNW54/zIKBTO1gFbAi0VFtcjKMievcc5E1N+1oVl8D1YTk1Vso?=
 =?us-ascii?Q?YJ0lvKm7C30QR+GiNfc/EjCu3+4oyDLFtitP5iRPSEFLrklzKPldFJnR/uMQ?=
 =?us-ascii?Q?fwxP2PIN3IMzF0EgI+AZRpB7vqjzZXOQ1J/1LoBaoWKVp8EqXFYgZMZfMzZo?=
 =?us-ascii?Q?JWxtnN9S0v7T6rHZxz/9LGDsMqNAggLy8Cr4NUG0yGPmrAUp59Y16FDbQEX3?=
 =?us-ascii?Q?9pvHwqvSezomYOyeDBsFHO+daGR9uQgDpYvZGb0UaolNRSWA3DR5NCx+raa/?=
 =?us-ascii?Q?Jv6xm04C1fpyAKexRZi5Y5wdBcIS7iEXh8+jcwDGMn08TAmJH4xSY1sxLu1L?=
 =?us-ascii?Q?t8Buxcs/4h17DhC/jqsYr5JHx5gJCsf7EvTgNwjKwsCKY7r7p04NCCq1IBPy?=
 =?us-ascii?Q?LG44FHFeKhPrPR/9uuHdniPIWH5BMPwtYN2E7sZihXGjhe5N31aQyTUbs1K0?=
 =?us-ascii?Q?k+xG2Oo0ul7oULdl2qCNlgZLzxepavR0G47ma1pUZdxyl1Ph5DYJlhdQsuwe?=
 =?us-ascii?Q?O4LeUhVDCKeVq5VdCBJxb4yA1NBcG74cljnyaR+0c5aCZWtxCdAozcErwH+s?=
 =?us-ascii?Q?C1PVlE+tql18yaTxRo9t5r7G6b13EbOwjjqsCb/UlmhdFcu4awOjztX9bTMM?=
 =?us-ascii?Q?+GhuCu00gzlxXfWKGvj1P/ZrGNC3dqdLO/SzUfbpkuOzcdzlaAEpeToBzz24?=
 =?us-ascii?Q?VpM9WIeLivLI5iX8fo1hKXFIgoEN12vBoV1jHmpsNmmKbesk0dcj7RQH06IQ?=
 =?us-ascii?Q?zq6LYLwT3DFpU7AwhsPImhjAePUuExK5ghEcXYpURYcKWPaK87pUx6HdQ44X?=
 =?us-ascii?Q?5onJYFXAc3sQVHok5qGtsOa5Ztw5qsEWb15WreBhHaofjrkg9m2pLC7/8WcJ?=
 =?us-ascii?Q?lTlsyw92klHYKgUYfeXyFJyg/9i3rT8rRy9hwcP9/8UpKIoaGnPa7uw8D8my?=
 =?us-ascii?Q?fBpfcWB/FKaHo57SOL23dvWSOdI2tCDz6rwXH2PLjwQJJHkPLgjKlt6+o8K3?=
 =?us-ascii?Q?RulWz9ueWUkt7SV/HhrhIxT9ufFx7eCZfQD2emgafgS6mtQHBLuDSvoEZ/uO?=
 =?us-ascii?Q?Co8CxhP86kfR55/8sJDXfsX5rCLjd6ZyJPVsg0AV2lggiqnQFoaCijUiUNyO?=
 =?us-ascii?Q?ufKg2LSA22MmO5OQXF93+bm/+88+La+KcD8AIdBkVwoVLVgBuT3wbkIEoxEZ?=
 =?us-ascii?Q?26FqPQXbYMBZE/MjBYfXFK8THW7aVE9PIwB9PsxF5NHtp+P1NfC69xcd4Wpc?=
 =?us-ascii?Q?UFfTggKCvn2xwDwoIOew7XzzldNwH2uiW/tfZeDGbxl8uIvmw7qggNVR4JuJ?=
 =?us-ascii?Q?Gztp2Q=3D=3D?=
X-OriginatorOrg: corigine.com
X-MS-Exchange-CrossTenant-Network-Message-Id: e642ee17-0110-4687-dbe0-08db180edd6e
X-MS-Exchange-CrossTenant-AuthSource: PH0PR13MB4842.namprd13.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 26 Feb 2023 15:33:53.4496
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: fe128f2c-073b-4c20-818e-7246a585940c
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: OGz6+axOiDWQ4WOt7RIr+oRT5dfrVndldrnpYTPJe09j3a7PTJO0c1rfadIBX8Hy3ljpg1+FKH1nIBR9kmekeQi2KKe8xYq5fZMXqUrSVDs=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CO3PR13MB5768
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Sun, Feb 26, 2023 at 05:59:33PM +0800, Kang Chen wrote:
> devm_kmalloc_array may fails, *fw_vsc_cfg might be null and cause
> out-of-bounds write in device_property_read_u8_array later.
> 
> Signed-off-by: Kang Chen <void0red@gmail.com>

I'm not sure if this is a bug-fix (for stable).
But if so, I think the following is the appropriate fixes tag.

Fixes: a06347c04c13 ("NFC: Add Intel Fields Peak NFC solution driver")

> ---
>  drivers/nfc/fdp/i2c.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/nfc/fdp/i2c.c b/drivers/nfc/fdp/i2c.c
> index 2d53e0f88..d95d20efa 100644
> --- a/drivers/nfc/fdp/i2c.c
> +++ b/drivers/nfc/fdp/i2c.c
> @@ -247,6 +247,9 @@ static void fdp_nci_i2c_read_device_properties(struct device *dev,
>  					   len, sizeof(**fw_vsc_cfg),
>  					   GFP_KERNEL);
>  
> +		if (!*fw_vsc_cfg)
> +			goto vsc_read_err;

This leads to:

	dev_dbg(dev, "FW vendor specific commands not present\n");

Which seems a little misleading for this error condition.

> +
>  		r = device_property_read_u8_array(dev, FDP_DP_FW_VSC_CFG_NAME,
>  						  *fw_vsc_cfg, len);
>  
> -- 
> 2.34.1
>