From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-eopbgr690104.outbound.protection.outlook.com ([40.107.69.104]:19838 "EHLO NAM04-CO1-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1727631AbeH3WHN (ORCPT ); Thu, 30 Aug 2018 18:07:13 -0400 From: Sasha Levin To: "stable@vger.kernel.org" CC: Anton Vasilyev , Linus Walleij , Sasha Levin Subject: [PATCH AUTOSEL 4.18 064/113] pinctrl: axp209: Fix NULL pointer dereference after allocation Date: Thu, 30 Aug 2018 18:03:43 +0000 Message-ID: <20180830180050.35735-64-alexander.levin@microsoft.com> References: <20180830180050.35735-1-alexander.levin@microsoft.com> In-Reply-To: <20180830180050.35735-1-alexander.levin@microsoft.com> Content-Language: en-US Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org List-ID: From: Anton Vasilyev [ Upstream commit 504c76979bccec66e4c2e41f6a006e49e284466f ] There is no check that allocation in axp20x_funcs_groups_from_mask is successful. The patch adds corresponding check and return values. Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Anton Vasilyev Acked-by: Chen-Yu Tsai Signed-off-by: Linus Walleij Signed-off-by: Sasha Levin --- drivers/pinctrl/pinctrl-axp209.c | 26 ++++++++++++++++++++------ 1 file changed, 20 insertions(+), 6 deletions(-) diff --git a/drivers/pinctrl/pinctrl-axp209.c b/drivers/pinctrl/pinctrl-axp= 209.c index a52779f33ad4..afd0b533c40a 100644 --- a/drivers/pinctrl/pinctrl-axp209.c +++ b/drivers/pinctrl/pinctrl-axp209.c @@ -316,7 +316,7 @@ static const struct pinctrl_ops axp20x_pctrl_ops =3D { .get_group_pins =3D axp20x_group_pins, }; =20 -static void axp20x_funcs_groups_from_mask(struct device *dev, unsigned int= mask, +static int axp20x_funcs_groups_from_mask(struct device *dev, unsigned int = mask, unsigned int mask_len, struct axp20x_pinctrl_function *func, const struct pinctrl_pin_desc *pins) @@ -331,18 +331,22 @@ static void axp20x_funcs_groups_from_mask(struct devi= ce *dev, unsigned int mask, func->groups =3D devm_kcalloc(dev, ngroups, sizeof(const char *), GFP_KERNEL); + if (!func->groups) + return -ENOMEM; group =3D func->groups; for_each_set_bit(bit, &mask_cpy, mask_len) { *group =3D pins[bit].name; group++; } } + + return 0; } =20 -static void axp20x_build_funcs_groups(struct platform_device *pdev) +static int axp20x_build_funcs_groups(struct platform_device *pdev) { struct axp20x_pctl *pctl =3D platform_get_drvdata(pdev); - int i, pin, npins =3D pctl->desc->npins; + int i, ret, pin, npins =3D pctl->desc->npins; =20 pctl->funcs[AXP20X_FUNC_GPIO_OUT].name =3D "gpio_out"; pctl->funcs[AXP20X_FUNC_GPIO_OUT].muxval =3D AXP20X_MUX_GPIO_OUT; @@ -366,13 +370,19 @@ static void axp20x_build_funcs_groups(struct platform= _device *pdev) pctl->funcs[i].groups[pin] =3D pctl->desc->pins[pin].name; } =20 - axp20x_funcs_groups_from_mask(&pdev->dev, pctl->desc->ldo_mask, + ret =3D axp20x_funcs_groups_from_mask(&pdev->dev, pctl->desc->ldo_mask, npins, &pctl->funcs[AXP20X_FUNC_LDO], pctl->desc->pins); + if (ret) + return ret; =20 - axp20x_funcs_groups_from_mask(&pdev->dev, pctl->desc->adc_mask, + ret =3D axp20x_funcs_groups_from_mask(&pdev->dev, pctl->desc->adc_mask, npins, &pctl->funcs[AXP20X_FUNC_ADC], pctl->desc->pins); + if (ret) + return ret; + + return 0; } =20 static const struct of_device_id axp20x_pctl_match[] =3D { @@ -424,7 +434,11 @@ static int axp20x_pctl_probe(struct platform_device *p= dev) =20 platform_set_drvdata(pdev, pctl); =20 - axp20x_build_funcs_groups(pdev); + ret =3D axp20x_build_funcs_groups(pdev); + if (ret) { + dev_err(&pdev->dev, "failed to build groups\n"); + return ret; + } =20 pctrl_desc =3D devm_kzalloc(&pdev->dev, sizeof(*pctrl_desc), GFP_KERNEL); if (!pctrl_desc) --=20 2.17.1