Re: [bug report] ACPI: PRM: implement OperationRegion handler for the PlatformRtMechanism subtype

From: Dan Carpenter <dan.carpenter@oracle.com>
To: erik.kaneda@intel.com
Cc: linux-acpi@vger.kernel.org
Subject: Re: [bug report] ACPI: PRM: implement OperationRegion handler for the PlatformRtMechanism subtype
Date: Fri, 18 Jun 2021 11:41:37 +0300	[thread overview]
Message-ID: <20210618084137.GS1901@kadam> (raw)
In-Reply-To: <YMxb17H5xf4SttpA@mwanda>

On Fri, Jun 18, 2021 at 11:39:51AM +0300, Dan Carpenter wrote:
> Hello Erik Kaneda,
> 
> The patch cefc7ca46235: "ACPI: PRM: implement OperationRegion handler
> for the PlatformRtMechanism subtype" from Jun 9, 2021, leads to the
> following static checker warning:
> 
> 	drivers/acpi/prmt.c:113 acpi_parse_prmt()
> 	error: potential null dereference 'tm'.  (kmalloc returns null)
> 
> drivers/acpi/prmt.c
>     95  static int __init
>     96  acpi_parse_prmt(union acpi_subtable_headers *header, const unsigned long end)
>     97  {
>     98          struct acpi_prmt_module_info *module_info;
>     99          struct acpi_prmt_handler_info *handler_info;
>    100          struct prm_handler_info *th;
>    101          struct prm_module_info *tm;
>    102          u64 mmio_count = 0;
>    103          u64 cur_handler = 0;
>    104          u32 module_info_size = 0;
>    105          u64 mmio_range_size = 0;
>    106          void *temp_mmio;
>    107  
>    108          module_info = (struct acpi_prmt_module_info *) header;
>    109          module_info_size = struct_size(tm, handlers, module_info->handler_info_count);
>    110          tm = kmalloc(module_info_size, GFP_KERNEL);
>                 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> Check for NULL?
> 
>    111  
>    112          guid_copy(&tm->guid, (guid_t *) module_info->module_guid);
>    113          tm->major_rev = module_info->major_rev;
>    114          tm->minor_rev = module_info->minor_rev;
>    115          tm->handler_count = module_info->handler_info_count;
>    116          tm->updatable = true;
>    117  
>    118          if (module_info->mmio_list_pointer) {
>    119                  /*
>    120                   * Each module is associated with a list of addr
>    121                   * ranges that it can use during the service
>    122                   */
>    123                  mmio_count = *(u64 *) memremap(module_info->mmio_list_pointer, 8, MEMREMAP_WB);
>    124                  mmio_range_size = struct_size(tm->mmio_info, addr_ranges, mmio_count);
>    125                  tm->mmio_info = kmalloc(mmio_range_size, GFP_KERNEL);

Also here:

drivers/acpi/prmt.c:131 acpi_parse_prmt() error: potential null dereference 'tm->mmio_info'.  (kmalloc returns null)

regards,
dan carpenter

>    126                  temp_mmio = memremap(module_info->mmio_list_pointer, mmio_range_size, MEMREMAP_WB);
>    127                  memmove(tm->mmio_info, temp_mmio, mmio_range_size);
>    128          } else {
>    129                  mmio_range_size = struct_size(tm->mmio_info, addr_ranges, mmio_count);
>    130                  tm->mmio_info = kmalloc(mmio_range_size, GFP_KERNEL);
>    131                  tm->mmio_info->mmio_count = 0;
>    132          }
>    133  
>    134          INIT_LIST_HEAD(&tm->module_list);
>    135          list_add(&tm->module_list, &prm_module_list);
> 
> regards,
> dan carpenter