From 6c59283972a45677ecb2bffffd2af34c15fbeee3 Mon Sep 17 00:00:00 2001 From: Oliver Neukum Date: Mar 19 2024 15:18:04 +0000 Subject: clk: zynq: Prevent null pointer dereference caused by kmalloc failure (git-fixes). --- diff --git a/patches.suse/clk-zynq-Prevent-null-pointer-dereference-caused-by-.patch b/patches.suse/clk-zynq-Prevent-null-pointer-dereference-caused-by-.patch new file mode 100644 index 0000000..80c23a9 --- /dev/null +++ b/patches.suse/clk-zynq-Prevent-null-pointer-dereference-caused-by-.patch @@ -0,0 +1,75 @@ +From 7938e9ce39d6779d2f85d822cc930f73420e54a6 Mon Sep 17 00:00:00 2001 +From: Duoming Zhou +Date: Fri, 1 Mar 2024 16:44:37 +0800 +Subject: [PATCH] clk: zynq: Prevent null pointer dereference caused by kmalloc + failure +Git-commit: 7938e9ce39d6779d2f85d822cc930f73420e54a6 +References: git-fixes +Patch-mainline: v6.9-rc1 + +The kmalloc() in zynq_clk_setup() will return null if the +physical memory has run out. As a result, if we use snprintf() +to write data to the null address, the null pointer dereference +bug will happen. + +This patch uses a stack variable to replace the kmalloc(). + +Fixes: 0ee52b157b8e ("clk: zynq: Add clock controller driver") +Suggested-by: Michal Simek +Suggested-by: Stephen Boyd +Signed-off-by: Duoming Zhou +Link: https://lore.kernel.org/r/20240301084437.16084-1-duoming@zju.edu.cn +Acked-by: Michal Simek +Signed-off-by: Stephen Boyd +Signed-off-by: Oliver Neukum + +--- + drivers/clk/zynq/clkc.c | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +diff --git a/drivers/clk/zynq/clkc.c b/drivers/clk/zynq/clkc.c +index 7bdeaff2bfd6..c28d3dacf0fb 100644 +--- a/drivers/clk/zynq/clkc.c ++++ b/drivers/clk/zynq/clkc.c +@@ -42,6 +42,7 @@ static void __iomem *zynq_clkc_base; + #define SLCR_SWDT_CLK_SEL (zynq_clkc_base + 0x204) + + #define NUM_MIO_PINS 54 ++#define CLK_NAME_LEN 16 + + #define DBG_CLK_CTRL_CLKACT_TRC BIT(0) + #define DBG_CLK_CTRL_CPU_1XCLKACT BIT(1) +@@ -215,7 +216,7 @@ static void __init zynq_clk_setup(struct device_node *np) + int i; + u32 tmp; + int ret; +- char *clk_name; ++ char clk_name[CLK_NAME_LEN]; + unsigned int fclk_enable = 0; + const char *clk_output_name[clk_max]; + const char *cpu_parents[4]; +@@ -426,12 +427,10 @@ static void __init zynq_clk_setup(struct device_node *np) + "gem1_emio_mux", CLK_SET_RATE_PARENT, + SLCR_GEM1_CLK_CTRL, 0, 0, &gem1clk_lock); + +- tmp = strlen("mio_clk_00x"); +- clk_name = kmalloc(tmp, GFP_KERNEL); + for (i = 0; i < NUM_MIO_PINS; i++) { + int idx; + +- snprintf(clk_name, tmp, "mio_clk_%2.2d", i); ++ snprintf(clk_name, CLK_NAME_LEN, "mio_clk_%2.2d", i); + idx = of_property_match_string(np, "clock-names", clk_name); + if (idx >= 0) + can_mio_mux_parents[i] = of_clk_get_parent_name(np, +@@ -439,7 +438,6 @@ static void __init zynq_clk_setup(struct device_node *np) + else + can_mio_mux_parents[i] = dummy_nm; + } +- kfree(clk_name); + clk_register_mux(NULL, "can_mux", periph_parents, 4, + CLK_SET_RATE_NO_REPARENT, SLCR_CAN_CLK_CTRL, 4, 2, 0, + &canclk_lock); +-- +2.44.0 + diff --git a/series.conf b/series.conf index 763f359..3f13301 100644 --- a/series.conf +++ b/series.conf @@ -45684,6 +45684,7 @@ patches.suse/nilfs2-prevent-kernel-bug-at-submit_bh_wbc.patch patches.suse/media-staging-ipu3-imgu-Set-fields-before-media_enti.patch patches.suse/media-imx-csc-scaler-fix-v4l2_ctrl_handler-memory-le.patch + patches.suse/clk-zynq-Prevent-null-pointer-dereference-caused-by-.patch # jejb/scsi for-next patches.suse/scsi-lpfc-Initialize-status-local-variable-in-lpfc_s.patch