| Message ID | 20240626-omap-usb-tll-counted_by-v2-1-4bedf20d1b51@gmail.com |
|---|---|
| State | New |
| Headers | show |
| Series | [v2] mfd: omap-usb-tll: use struct_size to allocate tll | expand |
On Wed, 26 Jun 2024 21:37:03 +0200, Javier Carrasco wrote: > Commit 16c2004d9e4d ("mfd: omap-usb-tll: Allocate driver data at once") > changed the memory allocation of 'tll' to consolidate it into a single > allocation, introducing an incorrect size calculation. > > In particular, the allocation for the array of pointers was converted > into a single-pointer allocation. > > [...] Applied, thanks! [1/1] mfd: omap-usb-tll: use struct_size to allocate tll commit: 1938e6882b89d1d01926ed3e0bbdd8346263c317 -- Lee Jones [李琼斯]
diff --git a/drivers/mfd/omap-usb-tll.c b/drivers/mfd/omap-usb-tll.c index b6303ddb013b..f68dd0281463 100644 --- a/drivers/mfd/omap-usb-tll.c +++ b/drivers/mfd/omap-usb-tll.c @@ -230,8 +230,7 @@ static int usbtll_omap_probe(struct platform_device *pdev) break; } - tll = devm_kzalloc(dev, sizeof(*tll) + sizeof(tll->ch_clk[nch]), - GFP_KERNEL); + tll = devm_kzalloc(dev, struct_size(tll, ch_clk, nch), GFP_KERNEL); if (!tll) { pm_runtime_put_sync(dev); pm_runtime_disable(dev);
Commit 16c2004d9e4d ("mfd: omap-usb-tll: Allocate driver data at once") changed the memory allocation of 'tll' to consolidate it into a single allocation, introducing an incorrect size calculation. In particular, the allocation for the array of pointers was converted into a single-pointer allocation. The memory allocation used to occur in two steps: tll = devm_kzalloc(dev, sizeof(struct usbtll_omap), GFP_KERNEL); tll->ch_clk = devm_kzalloc(dev, sizeof(struct clk *) * tll->nch, GFP_KERNEL); And it turned that into the following allocation: tll = devm_kzalloc(dev, sizeof(*tll) + sizeof(tll->ch_clk[nch]), GFP_KERNEL); sizeof(tll->ch_clk[nch]) returns the size of a single pointer instead of the expected nch pointers. This bug went unnoticed because the allocation size was small enough to fit within the minimum size of a memory allocation for this particular case [1]. The complete allocation can still be done at once with the struct_size macro, which comes in handy for structures with a trailing flexible array. Fix the memory allocation to obtain the original size again. Link: https://lore.kernel.org/all/202406261121.2FFD65647@keescook/ [1] Fixes: 16c2004d9e4d ("mfd: omap-usb-tll: Allocate driver data at once") Reviewed-by: Kees Cook <kees@kernel.org> Signed-off-by: Javier Carrasco <javier.carrasco.cruz@gmail.com> --- Changes in v2: - Patch 1/2: drop (applied). - Patch 2/2: turn into fix. - Link to v1: https://lore.kernel.org/r/20240620-omap-usb-tll-counted_by-v1-0-77797834bb9a@gmail.com --- drivers/mfd/omap-usb-tll.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) --- base-commit: b992b79ca8bc336fa8e2c80990b5af80ed8f36fd change-id: 20240620-omap-usb-tll-counted_by-aac57c173018 Best regards,