* [PATCH] nfc: fdp: add null check of devm_kmalloc_array in fdp_nci_i2c_read_device_properties @ 2023-02-26 9:59 Kang Chen 2023-02-26 15:33 ` Simon Horman 0 siblings, 1 reply; 9+ messages in thread From: Kang Chen @ 2023-02-26 9:59 UTC (permalink / raw) To: krzysztof.kozlowski; +Cc: netdev, linux-kernel, Kang Chen devm_kmalloc_array may fails, *fw_vsc_cfg might be null and cause out-of-bounds write in device_property_read_u8_array later. Signed-off-by: Kang Chen <void0red@gmail.com> --- drivers/nfc/fdp/i2c.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/nfc/fdp/i2c.c b/drivers/nfc/fdp/i2c.c index 2d53e0f88..d95d20efa 100644 --- a/drivers/nfc/fdp/i2c.c +++ b/drivers/nfc/fdp/i2c.c @@ -247,6 +247,9 @@ static void fdp_nci_i2c_read_device_properties(struct device *dev, len, sizeof(**fw_vsc_cfg), GFP_KERNEL); + if (!*fw_vsc_cfg) + goto vsc_read_err; + r = device_property_read_u8_array(dev, FDP_DP_FW_VSC_CFG_NAME, *fw_vsc_cfg, len); -- 2.34.1 ^ permalink raw reply related [flat|nested] 9+ messages in thread
* Re: [PATCH] nfc: fdp: add null check of devm_kmalloc_array in fdp_nci_i2c_read_device_properties 2023-02-26 9:59 [PATCH] nfc: fdp: add null check of devm_kmalloc_array in fdp_nci_i2c_read_device_properties Kang Chen @ 2023-02-26 15:33 ` Simon Horman 2023-02-27 1:26 ` Kang Chen 2023-02-27 1:41 ` [PATCH v2] " Kang Chen 0 siblings, 2 replies; 9+ messages in thread From: Simon Horman @ 2023-02-26 15:33 UTC (permalink / raw) To: Kang Chen; +Cc: krzysztof.kozlowski, netdev, linux-kernel On Sun, Feb 26, 2023 at 05:59:33PM +0800, Kang Chen wrote: > devm_kmalloc_array may fails, *fw_vsc_cfg might be null and cause > out-of-bounds write in device_property_read_u8_array later. > > Signed-off-by: Kang Chen <void0red@gmail.com> I'm not sure if this is a bug-fix (for stable). But if so, I think the following is the appropriate fixes tag. Fixes: a06347c04c13 ("NFC: Add Intel Fields Peak NFC solution driver") > --- > drivers/nfc/fdp/i2c.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/drivers/nfc/fdp/i2c.c b/drivers/nfc/fdp/i2c.c > index 2d53e0f88..d95d20efa 100644 > --- a/drivers/nfc/fdp/i2c.c > +++ b/drivers/nfc/fdp/i2c.c > @@ -247,6 +247,9 @@ static void fdp_nci_i2c_read_device_properties(struct device *dev, > len, sizeof(**fw_vsc_cfg), > GFP_KERNEL); > > + if (!*fw_vsc_cfg) > + goto vsc_read_err; This leads to: dev_dbg(dev, "FW vendor specific commands not present\n"); Which seems a little misleading for this error condition. > + > r = device_property_read_u8_array(dev, FDP_DP_FW_VSC_CFG_NAME, > *fw_vsc_cfg, len); > > -- > 2.34.1 > ^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH] nfc: fdp: add null check of devm_kmalloc_array in fdp_nci_i2c_read_device_properties 2023-02-26 15:33 ` Simon Horman @ 2023-02-27 1:26 ` Kang Chen 2023-02-27 1:41 ` [PATCH v2] " Kang Chen 1 sibling, 0 replies; 9+ messages in thread From: Kang Chen @ 2023-02-27 1:26 UTC (permalink / raw) To: Simon Horman; +Cc: krzysztof.kozlowski, netdev, linux-kernel Hi Simon, I will update the patch later. Thank you for your review. On Sun, Feb 26, 2023 at 11:33 PM Simon Horman <simon.horman@corigine.com> wrote: > > On Sun, Feb 26, 2023 at 05:59:33PM +0800, Kang Chen wrote: > > devm_kmalloc_array may fails, *fw_vsc_cfg might be null and cause > > out-of-bounds write in device_property_read_u8_array later. > > > > Signed-off-by: Kang Chen <void0red@gmail.com> > > I'm not sure if this is a bug-fix (for stable). > But if so, I think the following is the appropriate fixes tag. > > Fixes: a06347c04c13 ("NFC: Add Intel Fields Peak NFC solution driver") > > > --- > > drivers/nfc/fdp/i2c.c | 3 +++ > > 1 file changed, 3 insertions(+) > > > > diff --git a/drivers/nfc/fdp/i2c.c b/drivers/nfc/fdp/i2c.c > > index 2d53e0f88..d95d20efa 100644 > > --- a/drivers/nfc/fdp/i2c.c > > +++ b/drivers/nfc/fdp/i2c.c > > @@ -247,6 +247,9 @@ static void fdp_nci_i2c_read_device_properties(struct device *dev, > > len, sizeof(**fw_vsc_cfg), > > GFP_KERNEL); > > > > + if (!*fw_vsc_cfg) > > + goto vsc_read_err; > > This leads to: > > dev_dbg(dev, "FW vendor specific commands not present\n"); > > Which seems a little misleading for this error condition. > > > + > > r = device_property_read_u8_array(dev, FDP_DP_FW_VSC_CFG_NAME, > > *fw_vsc_cfg, len); > > > > -- > > 2.34.1 > > ^ permalink raw reply [flat|nested] 9+ messages in thread
* [PATCH v2] nfc: fdp: add null check of devm_kmalloc_array in fdp_nci_i2c_read_device_properties 2023-02-26 15:33 ` Simon Horman 2023-02-27 1:26 ` Kang Chen @ 2023-02-27 1:41 ` Kang Chen 2023-02-27 8:02 ` Krzysztof Kozlowski 1 sibling, 1 reply; 9+ messages in thread From: Kang Chen @ 2023-02-27 1:41 UTC (permalink / raw) To: simon.horman; +Cc: krzysztof.kozlowski, linux-kernel, netdev, void0red devm_kmalloc_array may fails, *fw_vsc_cfg might be null and cause out-of-bounds write in device_property_read_u8_array later. Fixes: a06347c04c13 ("NFC: Add Intel Fields Peak NFC solution driver") Signed-off-by: Kang Chen <void0red@gmail.com> --- v2 -> v1: add debug prompt and Fixes tag drivers/nfc/fdp/i2c.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/nfc/fdp/i2c.c b/drivers/nfc/fdp/i2c.c index 2d53e0f88..d3272a54b 100644 --- a/drivers/nfc/fdp/i2c.c +++ b/drivers/nfc/fdp/i2c.c @@ -247,6 +247,11 @@ static void fdp_nci_i2c_read_device_properties(struct device *dev, len, sizeof(**fw_vsc_cfg), GFP_KERNEL); + if (!*fw_vsc_cfg) { + dev_dbg(dev, "Not enough memory\n"); + goto out; + } + r = device_property_read_u8_array(dev, FDP_DP_FW_VSC_CFG_NAME, *fw_vsc_cfg, len); @@ -259,7 +264,7 @@ static void fdp_nci_i2c_read_device_properties(struct device *dev, dev_dbg(dev, "FW vendor specific commands not present\n"); *fw_vsc_cfg = NULL; } - +out: dev_dbg(dev, "Clock type: %d, clock frequency: %d, VSC: %s", *clock_type, *clock_freq, *fw_vsc_cfg != NULL ? "yes" : "no"); } -- 2.34.1 ^ permalink raw reply related [flat|nested] 9+ messages in thread
* Re: [PATCH v2] nfc: fdp: add null check of devm_kmalloc_array in fdp_nci_i2c_read_device_properties 2023-02-27 1:41 ` [PATCH v2] " Kang Chen @ 2023-02-27 8:02 ` Krzysztof Kozlowski 2023-02-27 9:30 ` [PATCH v3] " void0red 0 siblings, 1 reply; 9+ messages in thread From: Krzysztof Kozlowski @ 2023-02-27 8:02 UTC (permalink / raw) To: Kang Chen, simon.horman; +Cc: linux-kernel, netdev On 27/02/2023 02:41, Kang Chen wrote: > devm_kmalloc_array may fails, *fw_vsc_cfg might be null and cause > out-of-bounds write in device_property_read_u8_array later. > > Fixes: a06347c04c13 ("NFC: Add Intel Fields Peak NFC solution driver") > No blank lines between tags. > Signed-off-by: Kang Chen <void0red@gmail.com> > --- > v2 -> v1: add debug prompt and Fixes tag > > drivers/nfc/fdp/i2c.c | 7 ++++++- > 1 file changed, 6 insertions(+), 1 deletion(-) > > diff --git a/drivers/nfc/fdp/i2c.c b/drivers/nfc/fdp/i2c.c > index 2d53e0f88..d3272a54b 100644 > --- a/drivers/nfc/fdp/i2c.c > +++ b/drivers/nfc/fdp/i2c.c > @@ -247,6 +247,11 @@ static void fdp_nci_i2c_read_device_properties(struct device *dev, > len, sizeof(**fw_vsc_cfg), > GFP_KERNEL); > > + if (!*fw_vsc_cfg) { > + dev_dbg(dev, "Not enough memory\n"); No prints for memory allocation errors. Core prints it. Just go to err_kmalloc. > + goto out; > + } > + > r = device_property_read_u8_array(dev, FDP_DP_FW_VSC_CFG_NAME, > *fw_vsc_cfg, len); > > @@ -259,7 +264,7 @@ static void fdp_nci_i2c_read_device_properties(struct device *dev, > dev_dbg(dev, "FW vendor specific commands not present\n"); > *fw_vsc_cfg = NULL; > } > - Why? Line break seems nice here. > +out: > dev_dbg(dev, "Clock type: %d, clock frequency: %d, VSC: %s", > *clock_type, *clock_freq, *fw_vsc_cfg != NULL ? "yes" : "no"); > } Best regards, Krzysztof ^ permalink raw reply [flat|nested] 9+ messages in thread
* [PATCH v3] nfc: fdp: add null check of devm_kmalloc_array in fdp_nci_i2c_read_device_properties 2023-02-27 8:02 ` Krzysztof Kozlowski @ 2023-02-27 9:30 ` void0red 2023-02-27 9:44 ` Krzysztof Kozlowski ` (2 more replies) 0 siblings, 3 replies; 9+ messages in thread From: void0red @ 2023-02-27 9:30 UTC (permalink / raw) To: krzysztof.kozlowski; +Cc: linux-kernel, netdev, simon.horman, void0red From: Kang Chen <void0red@gmail.com> devm_kmalloc_array may fails, *fw_vsc_cfg might be null and cause out-of-bounds write in device_property_read_u8_array later. Fixes: a06347c04c13 ("NFC: Add Intel Fields Peak NFC solution driver") Signed-off-by: Kang Chen <void0red@gmail.com> --- v3 -> v2: remove useless prompt and blank lines between tags. v2 -> v1: add debug prompt and Fixes tag drivers/nfc/fdp/i2c.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/nfc/fdp/i2c.c b/drivers/nfc/fdp/i2c.c index 2d53e0f88..1e0f2297f 100644 --- a/drivers/nfc/fdp/i2c.c +++ b/drivers/nfc/fdp/i2c.c @@ -247,6 +247,9 @@ static void fdp_nci_i2c_read_device_properties(struct device *dev, len, sizeof(**fw_vsc_cfg), GFP_KERNEL); + if (!*fw_vsc_cfg) + goto alloc_err; + r = device_property_read_u8_array(dev, FDP_DP_FW_VSC_CFG_NAME, *fw_vsc_cfg, len); @@ -260,6 +263,7 @@ static void fdp_nci_i2c_read_device_properties(struct device *dev, *fw_vsc_cfg = NULL; } +alloc_err: dev_dbg(dev, "Clock type: %d, clock frequency: %d, VSC: %s", *clock_type, *clock_freq, *fw_vsc_cfg != NULL ? "yes" : "no"); } -- 2.34.1 ^ permalink raw reply related [flat|nested] 9+ messages in thread
* Re: [PATCH v3] nfc: fdp: add null check of devm_kmalloc_array in fdp_nci_i2c_read_device_properties 2023-02-27 9:30 ` [PATCH v3] " void0red @ 2023-02-27 9:44 ` Krzysztof Kozlowski 2023-02-27 12:12 ` Simon Horman 2023-02-28 11:00 ` patchwork-bot+netdevbpf 2 siblings, 0 replies; 9+ messages in thread From: Krzysztof Kozlowski @ 2023-02-27 9:44 UTC (permalink / raw) To: void0red; +Cc: linux-kernel, netdev, simon.horman On 27/02/2023 10:30, void0red wrote: > From: Kang Chen <void0red@gmail.com> > > devm_kmalloc_array may fails, *fw_vsc_cfg might be null and cause > out-of-bounds write in device_property_read_u8_array later. > > Fixes: a06347c04c13 ("NFC: Add Intel Fields Peak NFC solution driver") > Signed-off-by: Kang Chen <void0red@gmail.com> > --- > v3 -> v2: remove useless prompt and blank lines between tags. Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Best regards, Krzysztof ^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH v3] nfc: fdp: add null check of devm_kmalloc_array in fdp_nci_i2c_read_device_properties 2023-02-27 9:30 ` [PATCH v3] " void0red 2023-02-27 9:44 ` Krzysztof Kozlowski @ 2023-02-27 12:12 ` Simon Horman 2023-02-28 11:00 ` patchwork-bot+netdevbpf 2 siblings, 0 replies; 9+ messages in thread From: Simon Horman @ 2023-02-27 12:12 UTC (permalink / raw) To: void0red; +Cc: krzysztof.kozlowski, linux-kernel, netdev On Mon, Feb 27, 2023 at 05:30:37PM +0800, void0red wrote: > [You don't often get email from void0red@gmail.com. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ] > > From: Kang Chen <void0red@gmail.com> > > devm_kmalloc_array may fails, *fw_vsc_cfg might be null and cause > out-of-bounds write in device_property_read_u8_array later. > > Fixes: a06347c04c13 ("NFC: Add Intel Fields Peak NFC solution driver") > Signed-off-by: Kang Chen <void0red@gmail.com> Reviewed-by: Simon Horman <simon.horman@corigine.com> ^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH v3] nfc: fdp: add null check of devm_kmalloc_array in fdp_nci_i2c_read_device_properties 2023-02-27 9:30 ` [PATCH v3] " void0red 2023-02-27 9:44 ` Krzysztof Kozlowski 2023-02-27 12:12 ` Simon Horman @ 2023-02-28 11:00 ` patchwork-bot+netdevbpf 2 siblings, 0 replies; 9+ messages in thread From: patchwork-bot+netdevbpf @ 2023-02-28 11:00 UTC (permalink / raw) To: void0red; +Cc: krzysztof.kozlowski, linux-kernel, netdev, simon.horman Hello: This patch was applied to netdev/net.git (main) by Paolo Abeni <pabeni@redhat.com>: On Mon, 27 Feb 2023 17:30:37 +0800 you wrote: > From: Kang Chen <void0red@gmail.com> > > devm_kmalloc_array may fails, *fw_vsc_cfg might be null and cause > out-of-bounds write in device_property_read_u8_array later. > > Fixes: a06347c04c13 ("NFC: Add Intel Fields Peak NFC solution driver") > Signed-off-by: Kang Chen <void0red@gmail.com> > > [...] Here is the summary with links: - [v3] nfc: fdp: add null check of devm_kmalloc_array in fdp_nci_i2c_read_device_properties https://git.kernel.org/netdev/net/c/11f180a5d62a You are awesome, thank you! -- Deet-doot-dot, I am a bot. https://korg.docs.kernel.org/patchwork/pwbot.html ^ permalink raw reply [flat|nested] 9+ messages in thread
end of thread, other threads:[~2023-02-28 11:00 UTC | newest] Thread overview: 9+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2023-02-26 9:59 [PATCH] nfc: fdp: add null check of devm_kmalloc_array in fdp_nci_i2c_read_device_properties Kang Chen 2023-02-26 15:33 ` Simon Horman 2023-02-27 1:26 ` Kang Chen 2023-02-27 1:41 ` [PATCH v2] " Kang Chen 2023-02-27 8:02 ` Krzysztof Kozlowski 2023-02-27 9:30 ` [PATCH v3] " void0red 2023-02-27 9:44 ` Krzysztof Kozlowski 2023-02-27 12:12 ` Simon Horman 2023-02-28 11:00 ` patchwork-bot+netdevbpf
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).