All of lore.kernel.org
 help / color / mirror / Atom feed
From: Duoming Zhou <duoming@zju.edu.cn>
To: linux-kernel@vger.kernel.org
Cc: linux-arm-kernel@lists.infradead.org, linux-clk@vger.kernel.org,
	michal.simek@amd.com, sboyd@kernel.org, mturquette@baylibre.com,
	Duoming Zhou <duoming@zju.edu.cn>
Subject: [PATCH v2] clk: zynq: Prevent null pointer dereference caused by kmalloc failure
Date: Thu, 29 Feb 2024 20:22:50 +0800	[thread overview]
Message-ID: <20240229122250.24786-1-duoming@zju.edu.cn> (raw)

The kmalloc() in zynq_clk_setup() will return null if the
physical memory has run out. As a result, if we use snprintf
to write data to the null address, the null pointer dereference
bug will happen.

This patch adds a stack variable to replace the kmalloc().

Fixes: 0ee52b157b8e ("clk: zynq: Add clock controller driver")
Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
---
Changes in v2:
  - Use stack variable to replace kmalloc().

 drivers/clk/zynq/clkc.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/clk/zynq/clkc.c b/drivers/clk/zynq/clkc.c
index 7bdeaff2bfd..e4c4c9adf79 100644
--- a/drivers/clk/zynq/clkc.c
+++ b/drivers/clk/zynq/clkc.c
@@ -427,7 +427,7 @@ static void __init zynq_clk_setup(struct device_node *np)
 			SLCR_GEM1_CLK_CTRL, 0, 0, &gem1clk_lock);
 
 	tmp = strlen("mio_clk_00x");
-	clk_name = kmalloc(tmp, GFP_KERNEL);
+	char clk_name[tmp];
 	for (i = 0; i < NUM_MIO_PINS; i++) {
 		int idx;
 
@@ -439,7 +439,6 @@ static void __init zynq_clk_setup(struct device_node *np)
 		else
 			can_mio_mux_parents[i] = dummy_nm;
 	}
-	kfree(clk_name);
 	clk_register_mux(NULL, "can_mux", periph_parents, 4,
 			CLK_SET_RATE_NO_REPARENT, SLCR_CAN_CLK_CTRL, 4, 2, 0,
 			&canclk_lock);
-- 
2.17.1


WARNING: multiple messages have this Message-ID (diff)
From: Duoming Zhou <duoming@zju.edu.cn>
To: linux-kernel@vger.kernel.org
Cc: linux-arm-kernel@lists.infradead.org, linux-clk@vger.kernel.org,
	michal.simek@amd.com, sboyd@kernel.org, mturquette@baylibre.com,
	Duoming Zhou <duoming@zju.edu.cn>
Subject: [PATCH v2] clk: zynq: Prevent null pointer dereference caused by kmalloc failure
Date: Thu, 29 Feb 2024 20:22:50 +0800	[thread overview]
Message-ID: <20240229122250.24786-1-duoming@zju.edu.cn> (raw)

The kmalloc() in zynq_clk_setup() will return null if the
physical memory has run out. As a result, if we use snprintf
to write data to the null address, the null pointer dereference
bug will happen.

This patch adds a stack variable to replace the kmalloc().

Fixes: 0ee52b157b8e ("clk: zynq: Add clock controller driver")
Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
---
Changes in v2:
  - Use stack variable to replace kmalloc().

 drivers/clk/zynq/clkc.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/clk/zynq/clkc.c b/drivers/clk/zynq/clkc.c
index 7bdeaff2bfd..e4c4c9adf79 100644
--- a/drivers/clk/zynq/clkc.c
+++ b/drivers/clk/zynq/clkc.c
@@ -427,7 +427,7 @@ static void __init zynq_clk_setup(struct device_node *np)
 			SLCR_GEM1_CLK_CTRL, 0, 0, &gem1clk_lock);
 
 	tmp = strlen("mio_clk_00x");
-	clk_name = kmalloc(tmp, GFP_KERNEL);
+	char clk_name[tmp];
 	for (i = 0; i < NUM_MIO_PINS; i++) {
 		int idx;
 
@@ -439,7 +439,6 @@ static void __init zynq_clk_setup(struct device_node *np)
 		else
 			can_mio_mux_parents[i] = dummy_nm;
 	}
-	kfree(clk_name);
 	clk_register_mux(NULL, "can_mux", periph_parents, 4,
 			CLK_SET_RATE_NO_REPARENT, SLCR_CAN_CLK_CTRL, 4, 2, 0,
 			&canclk_lock);
-- 
2.17.1


_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

             reply	other threads:[~2024-02-29 12:23 UTC|newest]

Thread overview: 12+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2024-02-29 12:22 Duoming Zhou [this message]
2024-02-29 12:22 ` [PATCH v2] clk: zynq: Prevent null pointer dereference caused by kmalloc failure Duoming Zhou
2024-02-29 12:45 ` Michal Simek
2024-02-29 12:45   ` Michal Simek
2024-02-29 14:16   ` duoming
2024-02-29 14:16     ` duoming
2024-03-01  1:22     ` Stephen Boyd
2024-03-01  1:22       ` Stephen Boyd
2024-03-01  1:21   ` Stephen Boyd
2024-03-01  1:21     ` Stephen Boyd
2024-03-01  7:02     ` Michal Simek
2024-03-01  7:02       ` Michal Simek

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20240229122250.24786-1-duoming@zju.edu.cn \
    --to=duoming@zju.edu.cn \
    --cc=linux-arm-kernel@lists.infradead.org \
    --cc=linux-clk@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=michal.simek@amd.com \
    --cc=mturquette@baylibre.com \
    --cc=sboyd@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.