]>
Commit | Line | Data |
---|---|---|
ea78042b SL |
1 | From 7b6ccb2cfad508ee0de19245cc45aaedf1282991 Mon Sep 17 00:00:00 2001 |
2 | From: Sasha Levin <sashal@kernel.org> | |
3 | Date: Wed, 3 Apr 2024 09:42:21 +0800 | |
4 | Subject: spi: mchp-pci1xxx: Fix a possible null pointer dereference in | |
5 | pci1xxx_spi_probe | |
6 | ||
7 | From: Huai-Yuan Liu <qq810974084@gmail.com> | |
8 | ||
9 | [ Upstream commit 1f886a7bfb3faf4c1021e73f045538008ce7634e ] | |
10 | ||
11 | In function pci1xxxx_spi_probe, there is a potential null pointer that | |
12 | may be caused by a failed memory allocation by the function devm_kzalloc. | |
13 | Hence, a null pointer check needs to be added to prevent null pointer | |
14 | dereferencing later in the code. | |
15 | ||
16 | To fix this issue, spi_bus->spi_int[iter] should be checked. The memory | |
17 | allocated by devm_kzalloc will be automatically released, so just directly | |
18 | return -ENOMEM without worrying about memory leaks. | |
19 | ||
20 | Fixes: 1cc0cbea7167 ("spi: microchip: pci1xxxx: Add driver for SPI controller of PCI1XXXX PCIe switch") | |
21 | Signed-off-by: Huai-Yuan Liu <qq810974084@gmail.com> | |
22 | Link: https://msgid.link/r/20240403014221.969801-1-qq810974084@gmail.com | |
23 | Signed-off-by: Mark Brown <broonie@kernel.org> | |
24 | Signed-off-by: Sasha Levin <sashal@kernel.org> | |
25 | --- | |
26 | drivers/spi/spi-pci1xxxx.c | 2 ++ | |
27 | 1 file changed, 2 insertions(+) | |
28 | ||
29 | diff --git a/drivers/spi/spi-pci1xxxx.c b/drivers/spi/spi-pci1xxxx.c | |
30 | index 3638e974f5d49..06bf58b7e5d72 100644 | |
31 | --- a/drivers/spi/spi-pci1xxxx.c | |
32 | +++ b/drivers/spi/spi-pci1xxxx.c | |
33 | @@ -275,6 +275,8 @@ static int pci1xxxx_spi_probe(struct pci_dev *pdev, const struct pci_device_id * | |
34 | spi_bus->spi_int[iter] = devm_kzalloc(&pdev->dev, | |
35 | sizeof(struct pci1xxxx_spi_internal), | |
36 | GFP_KERNEL); | |
37 | + if (!spi_bus->spi_int[iter]) | |
38 | + return -ENOMEM; | |
39 | spi_sub_ptr = spi_bus->spi_int[iter]; | |
40 | spi_sub_ptr->spi_host = devm_spi_alloc_host(dev, sizeof(struct spi_controller)); | |
41 | if (!spi_sub_ptr->spi_host) | |
42 | -- | |
43 | 2.43.0 | |
44 |