Skip to content

Commit c9764fd

Browse files
Mani-Sadhasivambroonie
authored andcommitted
regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods
drvdata::gpiods is supposed to hold an array of 'gpio_desc' pointers. But the memory is allocated for only one pointer. This will lead to out-of-bounds access later in the code if 'config::ngpios' is > 1. So fix the code to allocate enough memory to hold 'config::ngpios' of GPIO descriptors. While at it, also move the check for memory allocation failure to be below the allocation to make it more readable. Cc: [email protected] # 5.0 Fixes: d6cd33a ("regulator: gpio: Convert to use descriptors") Signed-off-by: Manivannan Sadhasivam <[email protected]> Link: https://patch.msgid.link/[email protected] Signed-off-by: Mark Brown <[email protected]>
1 parent 6729c13 commit c9764fd

File tree

1 file changed

+4
-4
lines changed

1 file changed

+4
-4
lines changed

drivers/regulator/gpio-regulator.c

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -260,8 +260,10 @@ static int gpio_regulator_probe(struct platform_device *pdev)
260260
return -ENOMEM;
261261
}
262262

263-
drvdata->gpiods = devm_kzalloc(dev, sizeof(struct gpio_desc *),
264-
GFP_KERNEL);
263+
drvdata->gpiods = devm_kcalloc(dev, config->ngpios,
264+
sizeof(struct gpio_desc *), GFP_KERNEL);
265+
if (!drvdata->gpiods)
266+
return -ENOMEM;
265267

266268
if (config->input_supply) {
267269
drvdata->desc.supply_name = devm_kstrdup(&pdev->dev,
@@ -274,8 +276,6 @@ static int gpio_regulator_probe(struct platform_device *pdev)
274276
}
275277
}
276278

277-
if (!drvdata->gpiods)
278-
return -ENOMEM;
279279
for (i = 0; i < config->ngpios; i++) {
280280
drvdata->gpiods[i] = devm_gpiod_get_index(dev,
281281
NULL,

0 commit comments

Comments
 (0)