Patchwork pwm: Fix possible ZERO_SIZE_PTR pointer dereferencing error.

login
register
mail settings
Submitter Xiubo Li
Date Aug. 18, 2014, 9:08 a.m.
Message ID <1408352924-19122-1-git-send-email-Li.Xiubo@freescale.com>
Download mbox | patch
Permalink /patch/380772/
State Accepted
Headers show

Comments

Xiubo Li - Aug. 18, 2014, 9:08 a.m.
Since we cannot make sure the 'chip->npwm' will always be none zero here,
and then if either equal to zero, the kzalloc() will return ZERO_SIZE_PTR,
which equals to ((void *)16).

So this patch fix this with just doing the zero check before calling kzalloc().

Signed-off-by: Xiubo Li <Li.Xiubo@freescale.com>
---
 drivers/pwm/core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
Thierry Reding - Aug. 25, 2014, 12:38 p.m.
On Mon, Aug 18, 2014 at 05:08:44PM +0800, Xiubo Li wrote:
> Since we cannot make sure the 'chip->npwm' will always be none zero here,
> and then if either equal to zero, the kzalloc() will return ZERO_SIZE_PTR,
> which equals to ((void *)16).
> 
> So this patch fix this with just doing the zero check before calling kzalloc().
> 
> Signed-off-by: Xiubo Li <Li.Xiubo@freescale.com>
> ---
>  drivers/pwm/core.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

Applied, thanks.

Thierry

Patch

diff --git a/drivers/pwm/core.c b/drivers/pwm/core.c
index 4b66bf0..786d0f1 100644
--- a/drivers/pwm/core.c
+++ b/drivers/pwm/core.c
@@ -236,7 +236,7 @@  int pwmchip_add(struct pwm_chip *chip)
 	int ret;
 
 	if (!chip || !chip->dev || !chip->ops || !chip->ops->config ||
-	    !chip->ops->enable || !chip->ops->disable)
+	    !chip->ops->enable || !chip->ops->disable || !chip->npwm)
 		return -EINVAL;
 
 	mutex_lock(&pwm_lock);