All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH 1/2] usb: mtu3: fix memory corruption in mtu3_debugfs_regset()
@ 2020-12-03  8:41 ` Dan Carpenter
  0 siblings, 0 replies; 6+ messages in thread
From: Dan Carpenter @ 2020-12-03  8:41 UTC (permalink / raw)
  To: Chunfeng Yun
  Cc: Greg Kroah-Hartman, kernel-janitors, linux-usb, linux-mediatek

This code is using the wrong sizeof() so it does not allocate enough
memory.  It allocates 32 bytes but 72 are required.  That will lead to
memory corruption.

Fixes: ae07809255d3 ("usb: mtu3: add debugfs interface files")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
 drivers/usb/mtu3/mtu3_debugfs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/mtu3/mtu3_debugfs.c b/drivers/usb/mtu3/mtu3_debugfs.c
index fdeade6254ae..7537bfd651af 100644
--- a/drivers/usb/mtu3/mtu3_debugfs.c
+++ b/drivers/usb/mtu3/mtu3_debugfs.c
@@ -127,7 +127,7 @@ static void mtu3_debugfs_regset(struct mtu3 *mtu, void __iomem *base,
 	struct debugfs_regset32 *regset;
 	struct mtu3_regset *mregs;
 
-	mregs = devm_kzalloc(mtu->dev, sizeof(*regset), GFP_KERNEL);
+	mregs = devm_kzalloc(mtu->dev, sizeof(*mregs), GFP_KERNEL);
 	if (!mregs)
 		return;
 
-- 
2.29.2

^ permalink raw reply related	[flat|nested] 6+ messages in thread
* [PATCH 1/2] usb: mtu3: fix memory corruption in mtu3_debugfs_regset()
@ 2020-12-03  8:41 ` Dan Carpenter
  0 siblings, 0 replies; 6+ messages in thread
From: Dan Carpenter @ 2020-12-03  8:41 UTC (permalink / raw)
  To: Chunfeng Yun
  Cc: Greg Kroah-Hartman, kernel-janitors, linux-usb, linux-mediatek

This code is using the wrong sizeof() so it does not allocate enough
memory.  It allocates 32 bytes but 72 are required.  That will lead to
memory corruption.

Fixes: ae07809255d3 ("usb: mtu3: add debugfs interface files")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
 drivers/usb/mtu3/mtu3_debugfs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/mtu3/mtu3_debugfs.c b/drivers/usb/mtu3/mtu3_debugfs.c
index fdeade6254ae..7537bfd651af 100644
--- a/drivers/usb/mtu3/mtu3_debugfs.c
+++ b/drivers/usb/mtu3/mtu3_debugfs.c
@@ -127,7 +127,7 @@ static void mtu3_debugfs_regset(struct mtu3 *mtu, void __iomem *base,
 	struct debugfs_regset32 *regset;
 	struct mtu3_regset *mregs;
 
-	mregs = devm_kzalloc(mtu->dev, sizeof(*regset), GFP_KERNEL);
+	mregs = devm_kzalloc(mtu->dev, sizeof(*mregs), GFP_KERNEL);
 	if (!mregs)
 		return;
 
-- 
2.29.2


_______________________________________________
Linux-mediatek mailing list
Linux-mediatek@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-mediatek

^ permalink raw reply related	[flat|nested] 6+ messages in thread
* [PATCH 1/2] usb: mtu3: fix memory corruption in mtu3_debugfs_regset()
@ 2020-12-03  8:41 ` Dan Carpenter
  0 siblings, 0 replies; 6+ messages in thread
From: Dan Carpenter @ 2020-12-03  8:41 UTC (permalink / raw)
  To: Chunfeng Yun
  Cc: Greg Kroah-Hartman, linux-usb, linux-mediatek, kernel-janitors

This code is using the wrong sizeof() so it does not allocate enough
memory.  It allocates 32 bytes but 72 are required.  That will lead to
memory corruption.

Fixes: ae07809255d3 ("usb: mtu3: add debugfs interface files")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
 drivers/usb/mtu3/mtu3_debugfs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/mtu3/mtu3_debugfs.c b/drivers/usb/mtu3/mtu3_debugfs.c
index fdeade6254ae..7537bfd651af 100644
--- a/drivers/usb/mtu3/mtu3_debugfs.c
+++ b/drivers/usb/mtu3/mtu3_debugfs.c
@@ -127,7 +127,7 @@ static void mtu3_debugfs_regset(struct mtu3 *mtu, void __iomem *base,
 	struct debugfs_regset32 *regset;
 	struct mtu3_regset *mregs;
 
-	mregs = devm_kzalloc(mtu->dev, sizeof(*regset), GFP_KERNEL);
+	mregs = devm_kzalloc(mtu->dev, sizeof(*mregs), GFP_KERNEL);
 	if (!mregs)
 		return;
 
-- 
2.29.2


^ permalink raw reply related	[flat|nested] 6+ messages in thread
* Re: [PATCH 1/2] usb: mtu3: fix memory corruption in mtu3_debugfs_regset()
  2020-12-03  8:41 ` Dan Carpenter
  (?)
@ 2020-12-08  4:14   ` Chunfeng Yun
  -1 siblings, 0 replies; 6+ messages in thread
From: Chunfeng Yun @ 2020-12-08  4:14 UTC (permalink / raw)
  To: Dan Carpenter
  Cc: Greg Kroah-Hartman, kernel-janitors, linux-usb, linux-mediatek

T24gVGh1LCAyMDIwLTEyLTAzIGF0IDExOjQxICswMzAwLCBEYW4gQ2FycGVudGVyIHdyb3RlOg0K
PiBUaGlzIGNvZGUgaXMgdXNpbmcgdGhlIHdyb25nIHNpemVvZigpIHNvIGl0IGRvZXMgbm90IGFs
bG9jYXRlIGVub3VnaA0KPiBtZW1vcnkuICBJdCBhbGxvY2F0ZXMgMzIgYnl0ZXMgYnV0IDcyIGFy
ZSByZXF1aXJlZC4gIFRoYXQgd2lsbCBsZWFkIHRvDQo+IG1lbW9yeSBjb3JydXB0aW9uLg0KPiAN
Cj4gRml4ZXM6IGFlMDc4MDkyNTVkMyAoInVzYjogbXR1MzogYWRkIGRlYnVnZnMgaW50ZXJmYWNl
IGZpbGVzIikNCj4gU2lnbmVkLW9mZi1ieTogRGFuIENhcnBlbnRlciA8ZGFuLmNhcnBlbnRlckBv
cmFjbGUuY29tPg0KPiAtLS0NCj4gIGRyaXZlcnMvdXNiL210dTMvbXR1M19kZWJ1Z2ZzLmMgfCAy
ICstDQo+ICAxIGZpbGUgY2hhbmdlZCwgMSBpbnNlcnRpb24oKyksIDEgZGVsZXRpb24oLSkNCj4g
DQo+IGRpZmYgLS1naXQgYS9kcml2ZXJzL3VzYi9tdHUzL210dTNfZGVidWdmcy5jIGIvZHJpdmVy
cy91c2IvbXR1My9tdHUzX2RlYnVnZnMuYw0KPiBpbmRleCBmZGVhZGU2MjU0YWUuLjc1MzdiZmQ2
NTFhZiAxMDA2NDQNCj4gLS0tIGEvZHJpdmVycy91c2IvbXR1My9tdHUzX2RlYnVnZnMuYw0KPiAr
KysgYi9kcml2ZXJzL3VzYi9tdHUzL210dTNfZGVidWdmcy5jDQo+IEBAIC0xMjcsNyArMTI3LDcg
QEAgc3RhdGljIHZvaWQgbXR1M19kZWJ1Z2ZzX3JlZ3NldChzdHJ1Y3QgbXR1MyAqbXR1LCB2b2lk
IF9faW9tZW0gKmJhc2UsDQo+ICAJc3RydWN0IGRlYnVnZnNfcmVnc2V0MzIgKnJlZ3NldDsNCj4g
IAlzdHJ1Y3QgbXR1M19yZWdzZXQgKm1yZWdzOw0KPiAgDQo+IC0JbXJlZ3MgPSBkZXZtX2t6YWxs
b2MobXR1LT5kZXYsIHNpemVvZigqcmVnc2V0KSwgR0ZQX0tFUk5FTCk7DQo+ICsJbXJlZ3MgPSBk
ZXZtX2t6YWxsb2MobXR1LT5kZXYsIHNpemVvZigqbXJlZ3MpLCBHRlBfS0VSTkVMKTsNCj4gIAlp
ZiAoIW1yZWdzKQ0KPiAgCQlyZXR1cm47DQo+ICBBY2tlZC1ieTogQ2h1bmZlbmcgWXVuIDxjaHVu
ZmVuZy55dW5AbWVkaWF0ZWsuY29tPg0KDQpUaGFua3MNCg0KDQo

^ permalink raw reply	[flat|nested] 6+ messages in thread
* Re: [PATCH 1/2] usb: mtu3: fix memory corruption in mtu3_debugfs_regset()
@ 2020-12-08  4:14   ` Chunfeng Yun
  0 siblings, 0 replies; 6+ messages in thread
From: Chunfeng Yun @ 2020-12-08  4:14 UTC (permalink / raw)
  To: Dan Carpenter
  Cc: Greg Kroah-Hartman, kernel-janitors, linux-usb, linux-mediatek

On Thu, 2020-12-03 at 11:41 +0300, Dan Carpenter wrote:
> This code is using the wrong sizeof() so it does not allocate enough
> memory.  It allocates 32 bytes but 72 are required.  That will lead to
> memory corruption.
> 
> Fixes: ae07809255d3 ("usb: mtu3: add debugfs interface files")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> ---
>  drivers/usb/mtu3/mtu3_debugfs.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/usb/mtu3/mtu3_debugfs.c b/drivers/usb/mtu3/mtu3_debugfs.c
> index fdeade6254ae..7537bfd651af 100644
> --- a/drivers/usb/mtu3/mtu3_debugfs.c
> +++ b/drivers/usb/mtu3/mtu3_debugfs.c
> @@ -127,7 +127,7 @@ static void mtu3_debugfs_regset(struct mtu3 *mtu, void __iomem *base,
>  	struct debugfs_regset32 *regset;
>  	struct mtu3_regset *mregs;
>  
> -	mregs = devm_kzalloc(mtu->dev, sizeof(*regset), GFP_KERNEL);
> +	mregs = devm_kzalloc(mtu->dev, sizeof(*mregs), GFP_KERNEL);
>  	if (!mregs)
>  		return;
>  Acked-by: Chunfeng Yun <chunfeng.yun@mediatek.com>

Thanks


_______________________________________________
Linux-mediatek mailing list
Linux-mediatek@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-mediatek

^ permalink raw reply	[flat|nested] 6+ messages in thread
* Re: [PATCH 1/2] usb: mtu3: fix memory corruption in mtu3_debugfs_regset()
@ 2020-12-08  4:14   ` Chunfeng Yun
  0 siblings, 0 replies; 6+ messages in thread
From: Chunfeng Yun @ 2020-12-08  4:14 UTC (permalink / raw)
  To: Dan Carpenter
  Cc: Greg Kroah-Hartman, linux-usb, linux-mediatek, kernel-janitors

On Thu, 2020-12-03 at 11:41 +0300, Dan Carpenter wrote:
> This code is using the wrong sizeof() so it does not allocate enough
> memory.  It allocates 32 bytes but 72 are required.  That will lead to
> memory corruption.
> 
> Fixes: ae07809255d3 ("usb: mtu3: add debugfs interface files")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> ---
>  drivers/usb/mtu3/mtu3_debugfs.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/usb/mtu3/mtu3_debugfs.c b/drivers/usb/mtu3/mtu3_debugfs.c
> index fdeade6254ae..7537bfd651af 100644
> --- a/drivers/usb/mtu3/mtu3_debugfs.c
> +++ b/drivers/usb/mtu3/mtu3_debugfs.c
> @@ -127,7 +127,7 @@ static void mtu3_debugfs_regset(struct mtu3 *mtu, void __iomem *base,
>  	struct debugfs_regset32 *regset;
>  	struct mtu3_regset *mregs;
>  
> -	mregs = devm_kzalloc(mtu->dev, sizeof(*regset), GFP_KERNEL);
> +	mregs = devm_kzalloc(mtu->dev, sizeof(*mregs), GFP_KERNEL);
>  	if (!mregs)
>  		return;
>  Acked-by: Chunfeng Yun <chunfeng.yun@mediatek.com>

Thanks



^ permalink raw reply	[flat|nested] 6+ messages in thread
end of thread, other threads:[~2020-12-08  4:16 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2020-12-03  8:41 [PATCH 1/2] usb: mtu3: fix memory corruption in mtu3_debugfs_regset() Dan Carpenter
2020-12-03  8:41 ` Dan Carpenter
2020-12-03  8:41 ` Dan Carpenter
2020-12-08  4:14 ` Chunfeng Yun
2020-12-08  4:14   ` Chunfeng Yun
2020-12-08  4:14   ` Chunfeng Yun

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.