* [PATCH 1/2] usb: mtu3: fix memory corruption in mtu3_debugfs_regset()
@ 2020-12-03 8:41 Dan Carpenter
2020-12-08 4:14 ` Chunfeng Yun
0 siblings, 1 reply; 2+ messages in thread
From: Dan Carpenter @ 2020-12-03 8:41 UTC (permalink / raw)
To: Chunfeng Yun
Cc: Greg Kroah-Hartman, linux-usb, linux-mediatek, kernel-janitors
This code is using the wrong sizeof() so it does not allocate enough
memory. It allocates 32 bytes but 72 are required. That will lead to
memory corruption.
Fixes: ae07809255d3 ("usb: mtu3: add debugfs interface files")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
drivers/usb/mtu3/mtu3_debugfs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/usb/mtu3/mtu3_debugfs.c b/drivers/usb/mtu3/mtu3_debugfs.c
index fdeade6254ae..7537bfd651af 100644
--- a/drivers/usb/mtu3/mtu3_debugfs.c
+++ b/drivers/usb/mtu3/mtu3_debugfs.c
@@ -127,7 +127,7 @@ static void mtu3_debugfs_regset(struct mtu3 *mtu, void __iomem *base,
struct debugfs_regset32 *regset;
struct mtu3_regset *mregs;
- mregs = devm_kzalloc(mtu->dev, sizeof(*regset), GFP_KERNEL);
+ mregs = devm_kzalloc(mtu->dev, sizeof(*mregs), GFP_KERNEL);
if (!mregs)
return;
--
2.29.2
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH 1/2] usb: mtu3: fix memory corruption in mtu3_debugfs_regset()
2020-12-03 8:41 [PATCH 1/2] usb: mtu3: fix memory corruption in mtu3_debugfs_regset() Dan Carpenter
@ 2020-12-08 4:14 ` Chunfeng Yun
0 siblings, 0 replies; 2+ messages in thread
From: Chunfeng Yun @ 2020-12-08 4:14 UTC (permalink / raw)
To: Dan Carpenter
Cc: Greg Kroah-Hartman, linux-usb, linux-mediatek, kernel-janitors
On Thu, 2020-12-03 at 11:41 +0300, Dan Carpenter wrote:
> This code is using the wrong sizeof() so it does not allocate enough
> memory. It allocates 32 bytes but 72 are required. That will lead to
> memory corruption.
>
> Fixes: ae07809255d3 ("usb: mtu3: add debugfs interface files")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> ---
> drivers/usb/mtu3/mtu3_debugfs.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/usb/mtu3/mtu3_debugfs.c b/drivers/usb/mtu3/mtu3_debugfs.c
> index fdeade6254ae..7537bfd651af 100644
> --- a/drivers/usb/mtu3/mtu3_debugfs.c
> +++ b/drivers/usb/mtu3/mtu3_debugfs.c
> @@ -127,7 +127,7 @@ static void mtu3_debugfs_regset(struct mtu3 *mtu, void __iomem *base,
> struct debugfs_regset32 *regset;
> struct mtu3_regset *mregs;
>
> - mregs = devm_kzalloc(mtu->dev, sizeof(*regset), GFP_KERNEL);
> + mregs = devm_kzalloc(mtu->dev, sizeof(*mregs), GFP_KERNEL);
> if (!mregs)
> return;
> Acked-by: Chunfeng Yun <chunfeng.yun@mediatek.com>
Thanks
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2020-12-08 4:16 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2020-12-03 8:41 [PATCH 1/2] usb: mtu3: fix memory corruption in mtu3_debugfs_regset() Dan Carpenter
2020-12-08 4:14 ` Chunfeng Yun
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).