[PATCHv2] ata: ahci_tegra: remove devm_kcalloc()

[PATCHv2] ata: ahci_tegra: remove devm_kcalloc()

[Rosen Penev]

Combine allocations into one by using a flexible array member.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
---
 v2: Rebase
 drivers/ata/ahci_tegra.c | 15 ++++++---------
 1 file changed, 6 insertions(+), 9 deletions(-)

diff --git a/drivers/ata/ahci_tegra.c b/drivers/ata/ahci_tegra.c
index 554f05e09f98..142ba2ae1c83 100644
--- a/drivers/ata/ahci_tegra.c
+++ b/drivers/ata/ahci_tegra.c
@@ -176,8 +176,9 @@ struct tegra_ahci_priv {
 	/* Needs special handling, cannot use ahci_platform */
 	struct clk		   *sata_clk;
 	struct tegra_pmc	   *pmc;
-	struct regulator_bulk_data *supplies;
 	const struct tegra_ahci_soc *soc;
+
+	struct regulator_bulk_data supplies[];
 };
 
 static void tegra_ahci_handle_quirks(struct ahci_host_priv *hpriv)
@@ -514,6 +515,7 @@ static const struct scsi_host_template ahci_platform_sht = {
 
 static int tegra_ahci_probe(struct platform_device *pdev)
 {
+	const struct tegra_ahci_soc *soc;
 	struct ahci_host_priv *hpriv;
 	struct tegra_ahci_priv *tegra;
 	struct resource *res;
@@ -523,14 +525,15 @@ static int tegra_ahci_probe(struct platform_device *pdev)
 	if (IS_ERR(hpriv))
 		return PTR_ERR(hpriv);
 
-	tegra = devm_kzalloc(&pdev->dev, sizeof(*tegra), GFP_KERNEL);
+	soc = of_device_get_match_data(&pdev->dev);
+	tegra = devm_kzalloc(&pdev->dev, struct_size(tegra, supplies, soc->num_supplies), GFP_KERNEL);
 	if (!tegra)
 		return -ENOMEM;
 
 	hpriv->plat_data = tegra;
 
 	tegra->pdev = pdev;
-	tegra->soc = of_device_get_match_data(&pdev->dev);
+	tegra->soc = soc;
 
 	tegra->sata_regs = devm_platform_ioremap_resource(pdev, 1);
 	if (IS_ERR(tegra->sata_regs))
@@ -578,12 +581,6 @@ static int tegra_ahci_probe(struct platform_device *pdev)
 		return dev_err_probe(&pdev->dev, PTR_ERR(tegra->pmc),
 				     "failed to get PMC\n");
 
-	tegra->supplies = devm_kcalloc(&pdev->dev,
-				       tegra->soc->num_supplies,
-				       sizeof(*tegra->supplies), GFP_KERNEL);
-	if (!tegra->supplies)
-		return -ENOMEM;
-
 	regulator_bulk_set_supply_names(tegra->supplies,
 					tegra->soc->supply_names,
 					tegra->soc->num_supplies);
-- 
2.54.0

Re: [PATCHv2] ata: ahci_tegra: remove devm_kcalloc()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Unchecked dereference of `soc` when retrieving `soc->num_supplies` during memory allocation, leading to an immediate kernel panic if `of_device_get_match_data()` returns NULL.
--

commit bf92e6df451c5a93edb05970118c13a24829ffcf
Author: Rosen Penev <rosenp@gmail.com>

ata: ahci_tegra: remove devm_kcalloc()

This commit combines the allocation for the tegra_ahci_priv structure and
its supplies flexible array into a single allocation to remove the use of
devm_kcalloc().

> diff --git a/drivers/ata/ahci_tegra.c b/drivers/ata/ahci_tegra.c
> index 554f05e09f983..142ba2ae1c831 100644
> --- a/drivers/ata/ahci_tegra.c
> +++ b/drivers/ata/ahci_tegra.c

[ ... ]

> @@ -514,6 +515,7 @@ static const struct scsi_host_template ahci_platform_sht = {
>  
>  static int tegra_ahci_probe(struct platform_device *pdev)
>  {
> +	const struct tegra_ahci_soc *soc;
>  	struct ahci_host_priv *hpriv;
>  	struct tegra_ahci_priv *tegra;
>  	struct resource *res;
> @@ -523,14 +525,15 @@ static int tegra_ahci_probe(struct platform_device *pdev)
>  	if (IS_ERR(hpriv))
>  		return PTR_ERR(hpriv);
>  
> -	tegra = devm_kzalloc(&pdev->dev, sizeof(*tegra), GFP_KERNEL);
> +	soc = of_device_get_match_data(&pdev->dev);
> +	tegra = devm_kzalloc(&pdev->dev, struct_size(tegra, supplies, soc->num_supplies), GFP_KERNEL);

[Severity: High]
This isn't a bug introduced by this patch, but can of_device_get_match_data()
return NULL if the driver is probed via sysfs bind with driver_override?

If it returns NULL, the immediate dereference of soc->num_supplies in the
struct_size() macro will cause a NULL pointer dereference. While this
vulnerability existed in the codebase before this patch, this patch shifts
the dereference earlier in the probe sequence.

Could a NULL check be added for soc before it is dereferenced?

>  	if (!tegra)
>  		return -ENOMEM;
>

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260530004135.43088-1-rosenp@gmail.com?part=1