Commit 54598e23 authored by Duoming Zhou's avatar Duoming Zhou Committed by Yu Liao
Browse files

clk: zynq: Prevent null pointer dereference caused by kmalloc failure 

mainline inclusion
from mainline-v6.9-rc1
commit 7938e9ce39d6779d2f85d822cc930f73420e54a6
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L9NB
CVE: CVE-2024-27037

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7938e9ce39d6779d2f85d822cc930f73420e54a6



--------------------------------

The kmalloc() in zynq_clk_setup() will return null if the
physical memory has run out. As a result, if we use snprintf()
to write data to the null address, the null pointer dereference
bug will happen.

This patch uses a stack variable to replace the kmalloc().

Fixes: 0ee52b15 ("clk: zynq: Add clock controller driver")
Suggested-by: default avatarMichal Simek <michal.simek@amd.com>
Suggested-by: default avatarStephen Boyd <sboyd@kernel.org>
Signed-off-by: default avatarDuoming Zhou <duoming@zju.edu.cn>
Link: https://lore.kernel.org/r/20240301084437.16084-1-duoming@zju.edu.cn


Acked-by: default avatarMichal Simek <michal.simek@amd.com>
Signed-off-by: default avatarStephen Boyd <sboyd@kernel.org>
Conflicts:
	drivers/clk/zynq/clkc.c
[The conflicts were caused by not merged bf2244ba("clk: zynq:
clkc: Remove various instances of an unused variable 'clk'")]
Signed-off-by: default avatarYu Liao <liaoyu15@huawei.com>
parent f238d4e5

drivers/clk/zynq/clkc.c

+3 −5
Original line number Diff line number Diff line
@@ -42,6 +42,7 @@ static void __iomem *zynq_clkc_base; 
#define SLCR_SWDT_CLK_SEL		(zynq_clkc_base + 0x204)



#define NUM_MIO_PINS	54

#define CLK_NAME_LEN	16



#define DBG_CLK_CTRL_CLKACT_TRC		BIT(0)

#define DBG_CLK_CTRL_CPU_1XCLKACT	BIT(1)
@@ -218,7 +219,7 @@ static void __init zynq_clk_setup(struct device_node *np) 
	u32 tmp;

	int ret;

	struct clk *clk;

	char *clk_name;

	char clk_name[CLK_NAME_LEN];

	unsigned int fclk_enable = 0;

	const char *clk_output_name[clk_max];

	const char *cpu_parents[4];
@@ -428,12 +429,10 @@ static void __init zynq_clk_setup(struct device_node *np) 
			"gem1_emio_mux", CLK_SET_RATE_PARENT,

			SLCR_GEM1_CLK_CTRL, 0, 0, &gem1clk_lock);



	tmp = strlen("mio_clk_00x");

	clk_name = kmalloc(tmp, GFP_KERNEL);

	for (i = 0; i < NUM_MIO_PINS; i++) {

		int idx;



		snprintf(clk_name, tmp, "mio_clk_%2.2d", i);

		snprintf(clk_name, CLK_NAME_LEN, "mio_clk_%2.2d", i);

		idx = of_property_match_string(np, "clock-names", clk_name);

		if (idx >= 0)

			can_mio_mux_parents[i] = of_clk_get_parent_name(np,
@@ -441,7 +440,6 @@ static void __init zynq_clk_setup(struct device_node *np) 
		else

			can_mio_mux_parents[i] = dummy_nm;

	}

	kfree(clk_name);

	clk = clk_register_mux(NULL, "can_mux", periph_parents, 4,

			CLK_SET_RATE_NO_REPARENT, SLCR_CAN_CLK_CTRL, 4, 2, 0,

			&canclk_lock);