| Message ID | 20240303105729.78624-1-duoming@zju.edu.cn (mailing list archive) |
|---|---|
| State | Accepted |
| Delegated to: | Bjorn Helgaas |
| Headers | show |
| Series | PCI: of_property: handle int_map allocation failure | expand |
[+cc Lizhi (when you post a fix to a commit, please always cc the author of that original commit), Rob] On Sun, Mar 03, 2024 at 06:57:29PM +0800, Duoming Zhou wrote: > The kcalloc() in of_pci_prop_intr_map() will return null if > the physical memory has run out. As a result, both int_map > and mapp will point to the null area. If we dereference mapp, > the null pointer dereference bugs will happen. > > Return -ENOMEM from of_pci_prop_intr_map() if kcalloc() fails > for int_map. > > Fixes: 407d1a51921e ("PCI: Create device tree node for bridge") > Signed-off-by: Duoming Zhou <duoming@zju.edu.cn> Applied to pci/of for v6.10, thanks! Lizhi and Rob, let me know if you have any objections. > --- > drivers/pci/of_property.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/drivers/pci/of_property.c b/drivers/pci/of_property.c > index c2c7334152b..03539e50537 100644 > --- a/drivers/pci/of_property.c > +++ b/drivers/pci/of_property.c > @@ -238,6 +238,8 @@ static int of_pci_prop_intr_map(struct pci_dev *pdev, struct of_changeset *ocs, > return 0; > > int_map = kcalloc(map_sz, sizeof(u32), GFP_KERNEL); > + if (!int_map) > + return -ENOMEM; > mapp = int_map; > > list_for_each_entry(child, &pdev->subordinate->devices, bus_list) { > -- > 2.17.1 >
diff --git a/drivers/pci/of_property.c b/drivers/pci/of_property.c index c2c7334152b..03539e50537 100644 --- a/drivers/pci/of_property.c +++ b/drivers/pci/of_property.c @@ -238,6 +238,8 @@ static int of_pci_prop_intr_map(struct pci_dev *pdev, struct of_changeset *ocs, return 0; int_map = kcalloc(map_sz, sizeof(u32), GFP_KERNEL); + if (!int_map) + return -ENOMEM; mapp = int_map; list_for_each_entry(child, &pdev->subordinate->devices, bus_list) {
The kcalloc() in of_pci_prop_intr_map() will return null if the physical memory has run out. As a result, both int_map and mapp will point to the null area. If we dereference mapp, the null pointer dereference bugs will happen. Return -ENOMEM from of_pci_prop_intr_map() if kcalloc() fails for int_map. Fixes: 407d1a51921e ("PCI: Create device tree node for bridge") Signed-off-by: Duoming Zhou <duoming@zju.edu.cn> --- drivers/pci/of_property.c | 2 ++ 1 file changed, 2 insertions(+)