p71924506
/
linux_old1
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

nvmem: sunxi: Check for memory allocation failure 

The sunxi_sid driver doesn't check for kmalloc return status before
derefencing the returned pointer, which could lead to a NULL pointer
dereference if kmalloc failed. Check for its return code to make sure it
deosn't happen.

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Maxime Ripard <maxime.ripard@free-electrons.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Maxime Ripard 2015-09-30 13:36:31 +01:00 committed by Greg Kroah-Hartman
parent ace2217065
commit fb727077b0
1 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
drivers/nvmem/sunxi_sid.c
View File

@ -103,7 +103,7 @@ static int sunxi_sid_probe(struct platform_device *pdev)
struct nvmem_device *nvmem; struct nvmem_device *nvmem;
struct regmap *regmap; struct regmap *regmap;
struct sunxi_sid *sid; struct sunxi_sid *sid;
int i, size; int ret, i, size;
char *randomness; char *randomness;
sid = devm_kzalloc(dev, sizeof(*sid), GFP_KERNEL); sid = devm_kzalloc(dev, sizeof(*sid), GFP_KERNEL);
@ -131,6 +131,11 @@ static int sunxi_sid_probe(struct platform_device *pdev)
return PTR_ERR(nvmem); return PTR_ERR(nvmem);
randomness = kzalloc(sizeof(u8) * size, GFP_KERNEL); randomness = kzalloc(sizeof(u8) * size, GFP_KERNEL);
if (!randomness) {
ret = -EINVAL;
goto err_unreg_nvmem;
}
for (i = 0; i < size; i++) for (i = 0; i < size; i++)
randomness[i] = sunxi_sid_read_byte(sid, i); randomness[i] = sunxi_sid_read_byte(sid, i);
@ -140,6 +145,10 @@ static int sunxi_sid_probe(struct platform_device *pdev)
platform_set_drvdata(pdev, nvmem); platform_set_drvdata(pdev, nvmem);
return 0; return 0;
err_unreg_nvmem:
nvmem_unregister(nvmem);
return ret;
} }
static int sunxi_sid_remove(struct platform_device *pdev) static int sunxi_sid_remove(struct platform_device *pdev)