[PATCH 0/2] Fix NULL pointer dereference and use struct_size()

[PATCH 0/2] Fix NULL pointer dereference and use struct_size()

[Gustavo A. R. Silva]

Hi,

The first patch in this series fixes a potential NULL pointer
dereference by adding a NULL check. A tag for stable has been
added for this patch.

The second patch promotes the use of struct_size() in devm_kzalloc().

Both issues were detected with the help of Coccinelle.

Gustavo A. R. Silva (2):
  mfd: sm501: Fix potential NULL pointer dereference
  mfd: sm501: Use struct_size() in devm_kzalloc()

 drivers/mfd/sm501.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

-- 
2.20.1

[PATCH 1/2] mfd: sm501: Fix potential NULL pointer dereference

[Gustavo A. R. Silva]

There is a potential NULL pointer dereference in case devm_kzalloc()
fails and returns NULL.

Fix this by adding a NULL check on *lookup*

This bug was detected with the help of Coccinelle.

Fixes: b2e63555592f ("i2c: gpio: Convert to use descriptors")
Cc: stable@vger.kernel.org
Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
---
 drivers/mfd/sm501.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/mfd/sm501.c b/drivers/mfd/sm501.c
index a530972c5a7e..e0173bf4b0dc 100644
--- a/drivers/mfd/sm501.c
+++ b/drivers/mfd/sm501.c
@@ -1145,6 +1145,9 @@ static int sm501_register_gpio_i2c_instance(struct sm501_devdata *sm,
 	lookup = devm_kzalloc(&pdev->dev,
 			      sizeof(*lookup) + 3 * sizeof(struct gpiod_lookup),
 			      GFP_KERNEL);
+	if (!lookup)
+		return -ENOMEM;
+
 	lookup->dev_id = "i2c-gpio";
 	if (iic->pin_sda < 32)
 		lookup->table[0].chip_label = "SM501-LOW";
-- 
2.20.1

[PATCH 2/2] mfd: sm501: Use struct_size() in devm_kzalloc()

[Gustavo A. R. Silva]

One of the more common cases of allocation size calculations is finding
the size of a structure that has a zero-sized array at the end, along
with memory for some number of elements for that array. For example:

struct foo {
    int stuff;
    struct boo entry[];
};

instance = devm_kzalloc(dev, sizeof(struct foo) + count * sizeof(struct boo), GFP_KERNEL);

Instead of leaving these open-coded and prone to type mistakes, we can
now use the new struct_size() helper:

instance = devm_kzalloc(dev, struct_size(instance, entry, count), GFP_KERNEL);

This code was detected with the help of Coccinelle.

Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
---
 drivers/mfd/sm501.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/mfd/sm501.c b/drivers/mfd/sm501.c
index e0173bf4b0dc..d217debf382e 100644
--- a/drivers/mfd/sm501.c
+++ b/drivers/mfd/sm501.c
@@ -1142,8 +1142,7 @@ static int sm501_register_gpio_i2c_instance(struct sm501_devdata *sm,
 		return -ENOMEM;
 
 	/* Create a gpiod lookup using gpiochip-local offsets */
-	lookup = devm_kzalloc(&pdev->dev,
-			      sizeof(*lookup) + 3 * sizeof(struct gpiod_lookup),
+	lookup = devm_kzalloc(&pdev->dev, struct_size(lookup, table, 3),
 			      GFP_KERNEL);
 	if (!lookup)
 		return -ENOMEM;
-- 
2.20.1

Re: [PATCH 0/2] Fix NULL pointer dereference and use struct_size()

[Linus Walleij]

On Tue, Jan 22, 2019 at 5:55 PM Gustavo A. R. Silva
<gustavo@embeddedor.com> wrote:

> The first patch in this series fixes a potential NULL pointer
> dereference by adding a NULL check. A tag for stable has been
> added for this patch.
>
> The second patch promotes the use of struct_size() in devm_kzalloc().

Both patches:
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>

Yours,
Linus Walleij

Re: [PATCH 0/2] Fix NULL pointer dereference and use struct_size()

[Gustavo A. R. Silva]

On 1/26/19 7:20 AM, Linus Walleij wrote:
> On Tue, Jan 22, 2019 at 5:55 PM Gustavo A. R. Silva
> <gustavo@embeddedor.com> wrote:
> 
>> The first patch in this series fixes a potential NULL pointer
>> dereference by adding a NULL check. A tag for stable has been
>> added for this patch.
>>
>> The second patch promotes the use of struct_size() in devm_kzalloc().
> 
> Both patches:
> Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
> 

Thanks, Linus.

--
Gustavo

Re: [PATCH 1/2] mfd: sm501: Fix potential NULL pointer dereference

[Lee Jones]

On Tue, 22 Jan 2019, Gustavo A. R. Silva wrote:

> There is a potential NULL pointer dereference in case devm_kzalloc()
> fails and returns NULL.
> 
> Fix this by adding a NULL check on *lookup*
> 
> This bug was detected with the help of Coccinelle.
> 
> Fixes: b2e63555592f ("i2c: gpio: Convert to use descriptors")
> Cc: stable@vger.kernel.org
> Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
> ---
>  drivers/mfd/sm501.c | 3 +++
>  1 file changed, 3 insertions(+)

Applied, thanks.

-- 
Lee Jones [李琼斯]
Linaro Services Technical Lead
Linaro.org │ Open source software for ARM SoCs
Follow Linaro: Facebook | Twitter | Blog

Re: [PATCH 2/2] mfd: sm501: Use struct_size() in devm_kzalloc()

[Lee Jones]

On Tue, 22 Jan 2019, Gustavo A. R. Silva wrote:

> One of the more common cases of allocation size calculations is finding
> the size of a structure that has a zero-sized array at the end, along
> with memory for some number of elements for that array. For example:
> 
> struct foo {
>     int stuff;
>     struct boo entry[];
> };
> 
> instance = devm_kzalloc(dev, sizeof(struct foo) + count * sizeof(struct boo), GFP_KERNEL);
> 
> Instead of leaving these open-coded and prone to type mistakes, we can
> now use the new struct_size() helper:
> 
> instance = devm_kzalloc(dev, struct_size(instance, entry, count), GFP_KERNEL);
> 
> This code was detected with the help of Coccinelle.
> 
> Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
> ---
>  drivers/mfd/sm501.c | 3 +--
>  1 file changed, 1 insertion(+), 2 deletions(-)

Applied, thanks.

-- 
Lee Jones [李琼斯]
Linaro Services Technical Lead
Linaro.org │ Open source software for ARM SoCs
Follow Linaro: Facebook | Twitter | Blog

Re: [PATCH 1/2] mfd: sm501: Fix potential NULL pointer dereference

[Gustavo A. R. Silva]

On 1/30/19 7:35 AM, Lee Jones wrote:
> On Tue, 22 Jan 2019, Gustavo A. R. Silva wrote:
> 
>> There is a potential NULL pointer dereference in case devm_kzalloc()
>> fails and returns NULL.
>>
>> Fix this by adding a NULL check on *lookup*
>>
>> This bug was detected with the help of Coccinelle.
>>
>> Fixes: b2e63555592f ("i2c: gpio: Convert to use descriptors")
>> Cc: stable@vger.kernel.org
>> Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
>> ---
>>  drivers/mfd/sm501.c | 3 +++
>>  1 file changed, 3 insertions(+)
> 
> Applied, thanks.
> 

Thanks, Lee.

--
Gustavo