| Message ID | 1413922163-26356-1-git-send-email-kamal@canonical.com |
|---|---|
| State | New |
| Headers | show |
diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c index 1ac3c9a..ebe332c 100644 --- a/drivers/base/regmap/regmap.c +++ b/drivers/base/regmap/regmap.c @@ -1529,6 +1529,9 @@ int regmap_bulk_write(struct regmap *map, unsigned int reg, const void *val, if (val_bytes == 1) { wval = (void *)val; } else { + if (!val_count) + return -EINVAL; + wval = kmemdup(val, val_count * val_bytes, GFP_KERNEL); if (!wval) { ret = -ENOMEM;
This is a note to let you know that I have just added a patch titled regmap: fix possible ZERO_SIZE_PTR pointer dereferencing error. to the linux-3.13.y-queue branch of the 3.13.y.z extended stable tree which can be found at: http://kernel.ubuntu.com/git?p=ubuntu/linux.git;a=shortlog;h=refs/heads/linux-3.13.y-queue This patch is scheduled to be released in version 3.13.11.10. If you, or anyone else, feels it should not be added to this tree, please reply to this email. For more information about the 3.13.y.z tree, see https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable Thanks. -Kamal ------ From 6ae8fcd9d3e8fc346ff491ae08b76f6b148f8eb0 Mon Sep 17 00:00:00 2001 From: Xiubo Li <Li.Xiubo@freescale.com> Date: Sun, 28 Sep 2014 17:09:54 +0800 Subject: regmap: fix possible ZERO_SIZE_PTR pointer dereferencing error. commit d6b41cb06044a7d895db82bdd54f6e4219970510 upstream. Since we cannot make sure the 'val_count' will always be none zero here, and then if it equals to zero, the kmemdup() will return ZERO_SIZE_PTR, which equals to ((void *)16). So this patch fix this with just doing the zero check before calling kmemdup(). Signed-off-by: Xiubo Li <Li.Xiubo@freescale.com> Signed-off-by: Mark Brown <broonie@kernel.org> Signed-off-by: Kamal Mostafa <kamal@canonical.com> --- drivers/base/regmap/regmap.c | 3 +++ 1 file changed, 3 insertions(+) -- 1.9.1