From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752354AbdLMJ3R (ORCPT ); Wed, 13 Dec 2017 04:29:17 -0500 Received: from mail-wr0-f196.google.com ([209.85.128.196]:36923 "EHLO mail-wr0-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752487AbdLMJ2Y (ORCPT ); Wed, 13 Dec 2017 04:28:24 -0500 X-Google-Smtp-Source: ACJfBovcxsgIi8XmiOCJmvOvL8nMvWARXLi0uyHhOW9YGj3bTW7ulkVYp7sRB9TjNHdB9U3Ex3lMBw== From: Bartosz Golaszewski To: Mark Brown , Greg Kroah-Hartman Cc: linux-kernel@vger.kernel.org, Lars-Peter Clausen , Andy Shevchenko , Bartosz Golaszewski Subject: [PATCH 3/3] regmap: duplicate the name string stored in regmap Date: Wed, 13 Dec 2017 10:28:12 +0100 Message-Id: <20171213092812.26472-4-brgl@bgdev.pl> X-Mailer: git-send-email 2.15.1 In-Reply-To: <20171213092812.26472-1-brgl@bgdev.pl> References: <20171213092812.26472-1-brgl@bgdev.pl> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Currently we just copy over the pointer passed to regmap_init() in the regmap config struct. To be on the safe side: duplicate the string so that if an unaware user passes an address to a stack-allocated buffer, we won't crash. Signed-off-by: Bartosz Golaszewski --- drivers/base/regmap/regmap.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c index a2a02ce58824..3952e5d7638a 100644 --- a/drivers/base/regmap/regmap.c +++ b/drivers/base/regmap/regmap.c @@ -672,6 +672,14 @@ struct regmap *__regmap_init(struct device *dev, goto err; } + if (config->name) { + map->name = kstrdup(config->name, GFP_KERNEL); + if (!map->name) { + ret = -ENOMEM; + goto err_map; + } + } + if (config->disable_locking) { map->locking_disabled = true; map->lock = map->unlock = regmap_lock_unlock_none; @@ -763,7 +771,6 @@ struct regmap *__regmap_init(struct device *dev, map->volatile_reg = config->volatile_reg; map->precious_reg = config->precious_reg; map->cache_type = config->cache_type; - map->name = config->name; spin_lock_init(&map->async_lock); INIT_LIST_HEAD(&map->async_list); @@ -1308,6 +1315,7 @@ void regmap_exit(struct regmap *map) } if (map->hwlock) hwspin_lock_free(map->hwlock); + kfree(map->name); kfree(map); } EXPORT_SYMBOL_GPL(regmap_exit); -- 2.15.1