| Message ID | 20240905014753.353271-1-make24@iscas.ac.cn (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | mt76: mt7615: check devm_kasprintf() returned value | expand |
On 05/09/2024 03:47, Ma Ke wrote: > devm_kasprintf() can return a NULL pointer on failure but this returned > value is not checked. Fix this lack and check the returned value. > > Found by code review. > > Cc: stable@vger.kernel.org > Fixes: 0bb4e9187ea4 ("mt76: mt7615: fix hwmon temp sensor mem use-after-free") > Signed-off-by: Ma Ke <make24@iscas.ac.cn> Reviewed-by: Matthias Brugger <matthias.bgg@gmail.com> If you find more problems of that sort in the mediatek wireless drivers, I think a better approach would be to send them all as one patch. > --- > drivers/net/wireless/mediatek/mt76/mt7615/init.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/init.c b/drivers/net/wireless/mediatek/mt76/mt7615/init.c > index f7722f67db57..0b9ebdcda221 100644 > --- a/drivers/net/wireless/mediatek/mt76/mt7615/init.c > +++ b/drivers/net/wireless/mediatek/mt76/mt7615/init.c > @@ -56,6 +56,9 @@ int mt7615_thermal_init(struct mt7615_dev *dev) > > name = devm_kasprintf(&wiphy->dev, GFP_KERNEL, "mt7615_%s", > wiphy_name(wiphy)); > + if (!name) > + return -ENOMEM; > + > hwmon = devm_hwmon_device_register_with_groups(&wiphy->dev, name, dev, > mt7615_hwmon_groups); > return PTR_ERR_OR_ZERO(hwmon);
diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/init.c b/drivers/net/wireless/mediatek/mt76/mt7615/init.c index f7722f67db57..0b9ebdcda221 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7615/init.c +++ b/drivers/net/wireless/mediatek/mt76/mt7615/init.c @@ -56,6 +56,9 @@ int mt7615_thermal_init(struct mt7615_dev *dev) name = devm_kasprintf(&wiphy->dev, GFP_KERNEL, "mt7615_%s", wiphy_name(wiphy)); + if (!name) + return -ENOMEM; + hwmon = devm_hwmon_device_register_with_groups(&wiphy->dev, name, dev, mt7615_hwmon_groups); return PTR_ERR_OR_ZERO(hwmon);
devm_kasprintf() can return a NULL pointer on failure but this returned value is not checked. Fix this lack and check the returned value. Found by code review. Cc: stable@vger.kernel.org Fixes: 0bb4e9187ea4 ("mt76: mt7615: fix hwmon temp sensor mem use-after-free") Signed-off-by: Ma Ke <make24@iscas.ac.cn> --- drivers/net/wireless/mediatek/mt76/mt7615/init.c | 3 +++ 1 file changed, 3 insertions(+)