Commit ee19a73e authored by Kunwu Chan's avatar Kunwu Chan Committed by Chen Ridong
Browse files

mfd: syscon: Fix null pointer dereference in of_syscon_register() 

mainline inclusion
from mainline-v6.8-rc1
commit 41673c66b3d0c09915698fec5c13b24336f18dd1
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I93L7E
CVE: CVE-2023-52467

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=41673c66b3d0c09915698fec5c13b24336f18dd1



----------------------------------------------------------------------

kasprintf() returns a pointer to dynamically allocated memory
which can be NULL upon failure.

Fixes: e15d7f2b ("mfd: syscon: Use a unique name with regmap_config")
Signed-off-by: default avatarKunwu Chan <chentao@kylinos.cn>
Reviewed-by: default avatarArnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/r/20231204092443.2462115-1-chentao@kylinos.cn


Signed-off-by: default avatarLee Jones <lee@kernel.org>
Signed-off-by: default avatarChen Ridong <chenridong@huawei.com>
parent 0b6927f0

drivers/mfd/syscon.c

+4 −0
Original line number Diff line number Diff line
@@ -103,6 +103,10 @@ static struct syscon *of_syscon_register(struct device_node *np, bool check_clk) 


	syscon_config.name = kasprintf(GFP_KERNEL, "%pOFn@%llx", np,

				       (u64)res.start);

	if (!syscon_config.name) {

		ret = -ENOMEM;

		goto err_regmap;

	}

	syscon_config.reg_stride = reg_io_width;

	syscon_config.val_bits = reg_io_width * 8;

	syscon_config.max_register = resource_size(&res) - reg_io_width;