Received-SPF: pass (google.com: domain of linux-kernel+bounces-89710-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:4601:e00::3 as permitted sender) client-ip=2604:1380:4601:e00::3;
From: Duoming Zhou <duoming@zju.edu.cn>
To: linux-pci@vger.kernel.org
Cc: linux-kernel@vger.kernel.org,
	bhelgaas@google.com,
	Duoming Zhou <duoming@zju.edu.cn>
Subject: [PATCH] PCI: of_property: handle int_map allocation failure
Date: Sun,  3 Mar 2024 18:57:29 +0800
Message-Id: <20240303105729.78624-1-duoming@zju.edu.cn>
Precedence: bulk

The kcalloc() in of_pci_prop_intr_map() will return null if
the physical memory has run out. As a result, both int_map
and mapp will point to the null area. If we dereference mapp,
the null pointer dereference bugs will happen.

Return -ENOMEM from of_pci_prop_intr_map() if kcalloc() fails
for int_map.

Fixes: 407d1a51921e ("PCI: Create device tree node for bridge")
Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
---
 drivers/pci/of_property.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/pci/of_property.c b/drivers/pci/of_property.c
index c2c7334152b..03539e50537 100644
--- a/drivers/pci/of_property.c
+++ b/drivers/pci/of_property.c
@@ -238,6 +238,8 @@ static int of_pci_prop_intr_map(struct pci_dev *pdev, struct of_changeset *ocs,
 		return 0;
 
 	int_map = kcalloc(map_sz, sizeof(u32), GFP_KERNEL);
+	if (!int_map)
+		return -ENOMEM;
 	mapp = int_map;
 
 	list_for_each_entry(child, &pdev->subordinate->devices, bus_list) {
-- 
2.17.1