Skip to content

Commit 11f180a

Browse files
void0redPaolo Abeni
authored andcommitted
nfc: fdp: add null check of devm_kmalloc_array in fdp_nci_i2c_read_device_properties
devm_kmalloc_array may fails, *fw_vsc_cfg might be null and cause out-of-bounds write in device_property_read_u8_array later. Fixes: a06347c ("NFC: Add Intel Fields Peak NFC solution driver") Signed-off-by: Kang Chen <[email protected]> Reviewed-by: Krzysztof Kozlowski <[email protected]> Reviewed-by: Simon Horman <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Paolo Abeni <[email protected]>
1 parent f99e6d7 commit 11f180a

File tree

1 file changed

+4
-0
lines changed

1 file changed

+4
-0
lines changed

drivers/nfc/fdp/i2c.c

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -247,6 +247,9 @@ static void fdp_nci_i2c_read_device_properties(struct device *dev,
247247
len, sizeof(**fw_vsc_cfg),
248248
GFP_KERNEL);
249249

250+
if (!*fw_vsc_cfg)
251+
goto alloc_err;
252+
250253
r = device_property_read_u8_array(dev, FDP_DP_FW_VSC_CFG_NAME,
251254
*fw_vsc_cfg, len);
252255

@@ -260,6 +263,7 @@ static void fdp_nci_i2c_read_device_properties(struct device *dev,
260263
*fw_vsc_cfg = NULL;
261264
}
262265

266+
alloc_err:
263267
dev_dbg(dev, "Clock type: %d, clock frequency: %d, VSC: %s",
264268
*clock_type, *clock_freq, *fw_vsc_cfg != NULL ? "yes" : "no");
265269
}

0 commit comments

Comments
 (0)