microsoft
/
WSL2-Linux-Kernel
зеркало из https://github.com/microsoft/WSL2-Linux-Kernel.git
1
0
Форкнуть 0
Код Задачи Пакеты Проекты Релизы Вики Активность
WSL2-Linux-Kernel/drivers/mfd
История
Javier Carrasco b0fece1682 mfd: omap-usb-tll: Use struct_size to allocate tll 
[ Upstream commit 40176714c818b0b6a2ca8213cdb7654fbd49b742 ]

Commit 16c2004d9e ("mfd: omap-usb-tll: Allocate driver data at once")
changed the memory allocation of 'tll' to consolidate it into a single
allocation, introducing an incorrect size calculation.

In particular, the allocation for the array of pointers was converted
into a single-pointer allocation.

The memory allocation used to occur in two steps:

tll = devm_kzalloc(dev, sizeof(struct usbtll_omap), GFP_KERNEL);
tll->ch_clk = devm_kzalloc(dev, sizeof(struct clk *) * tll->nch,
                           GFP_KERNEL);

And it turned that into the following allocation:

tll = devm_kzalloc(dev, sizeof(*tll) + sizeof(tll->ch_clk[nch]),
                   GFP_KERNEL);

sizeof(tll->ch_clk[nch]) returns the size of a single pointer instead of
the expected nch pointers.

This bug went unnoticed because the allocation size was small enough to
fit within the minimum size of a memory allocation for this particular
case [1].

The complete allocation can still be done at once with the struct_size
macro, which comes in handy for structures with a trailing flexible
array.

Fix the memory allocation to obtain the original size again.

Link: https://lore.kernel.org/all/202406261121.2FFD65647@keescook/ [1]
Fixes: 16c2004d9e ("mfd: omap-usb-tll: Allocate driver data at once")
Reviewed-by: Kees Cook <kees@kernel.org>
Signed-off-by: Javier Carrasco <javier.carrasco.cruz@gmail.com>
Fixes: commit 16c2004d9e ("mfd: omap-usb-tll: Allocate driver data at once")
Link: https://lore.kernel.org/r/20240626-omap-usb-tll-counted_by-v2-1-4bedf20d1b51@gmail.com
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 		2024-08-19 05:45:03 +02:00
..
88pm80x.c
…
88pm800.c mfd: 88pm800: Use DEFINE_RES_IRQ_NAMED() to simplify code 2021-06-02 10:51:19 +01:00
88pm805.c mfd: 88pm805: Use DEFINE_RES_IRQ_NAMED() to simplify code 2021-06-02 10:51:19 +01:00
88pm860x-core.c
…
88pm860x-i2c.c
…
Kconfig mfd: ti_am335x_tscadc: Fix TI SoC dependencies 2024-02-23 08:54:50 +01:00
Makefile mfd: rsmu: Split core code into separate module 2024-08-19 05:45:02 +02:00
aat2870-core.c
…
ab8500-core.c mfd: Don't use irq_create_mapping() to resolve a mapping 2021-08-05 12:41:06 +01:00
ab8500-debugfs.c mfd: ab8500-debugfs: Remove extraneous seq_putc 2020-12-26 09:19:49 -08:00
ab8500-sysctrl.c
…
abx500-core.c
…
ac100.c
…
acer-ec-a500.c mfd: Add driver for Embedded Controller found on Acer Iconia Tab A500 2021-02-08 13:54:22 +00:00
act8945a.c
…
adp5520.c
…
altera-a10sr.c
…
altera-sysmgr.c mfd: altera-sysmgr: Call of_node_put() only when of_parse_phandle() takes a ref 2024-03-26 18:21:29 -04:00
arizona-core.c mfd: arizona: Use pm_runtime_resume_and_get() to prevent refcnt leak 2023-03-11 13:57:32 +01:00
arizona-i2c.c mfd: arizona: Replace arizona_of_get_type() with device_get_match_data() 2021-02-04 13:54:56 +00:00
arizona-irq.c mfd: arizona: Fix rumtime PM imbalance on error 2021-04-14 16:06:40 +01:00
arizona-spi.c mfd: arizona-spi: Set pdata.hpdet_channel for ACPI enumerated devs 2023-11-20 11:08:24 +01:00
arizona.h mfd: arizona: Replace arizona_of_get_type() with device_get_match_data() 2021-02-04 13:54:56 +00:00
as3711.c
…
as3722.c mfd: as3722: Use DEFINE_RES_IRQ_NAMED() to simplify code 2021-06-02 10:51:19 +01:00
asic3.c mfd: asic3: Add missing iounmap() on error asic3_mfd_probe 2022-04-08 14:23:43 +02:00
at91-usart.c
…
atc260x-core.c mfd: Add MFD driver for ATC260x PMICs 2021-03-10 11:10:23 +00:00
atc260x-i2c.c mfd: Make symbol 'atc260x_i2c_of_match' static 2021-04-14 16:06:15 +01:00
atmel-flexcom.c mfd: atmel-flexcom: Use .resume_noirq 2022-01-27 11:03:18 +01:00
atmel-hlcdc.c
…
atmel-smc.c
…
axp20x-i2c.c mfd/bus: sunxi-rsb: Make .remove() callback return void 2021-01-15 13:23:36 +00:00
axp20x-rsb.c mfd/bus: sunxi-rsb: Make .remove() callback return void 2021-01-15 13:23:36 +00:00
axp20x.c mfd: axp20x: Add supplied-from property to axp288_fuel_gauge cell 2021-08-05 14:11:04 +01:00
bcm590xx.c
…
bcm2835-pm.c
…
bd9571mwv.c mfd: bd9571mwv: Add support for BD9574MWF 2021-01-14 13:05:55 +00:00
cros_ec_dev.c mfd: cros_ec: Add peripheral device charger 2021-06-22 12:53:03 +01:00
cs47l15-tables.c
…
cs47l24-tables.c
…
cs47l35-tables.c
…
cs47l85-tables.c
…
cs47l90-tables.c
…
cs47l92-tables.c
…
cs5535-mfd.c
…
da903x.c
…
da9052-core.c
…
da9052-i2c.c mfd: da9052: Simplify getting of_device_id match data 2021-06-02 10:51:17 +01:00
da9052-irq.c
…
da9052-spi.c
…
da9055-core.c mfd: da9055: Use DEFINE_RES_IRQ_NAMED() to simplify code 2021-06-02 10:51:19 +01:00
da9055-i2c.c
…
da9062-core.c mfd: da9062: Simplify getting of_device_id match data 2021-06-02 10:51:18 +01:00
da9063-core.c
…
da9063-i2c.c mfd: da9063: Propagate errno when I2C mode fails 2021-06-02 10:51:17 +01:00
da9063-irq.c
…
da9150-core.c
…
davinci_voicecodec.c mfd: davinci_voicecodec: Fix possible null-ptr-deref davinci_vc_probe() 2022-06-09 10:23:12 +02:00
db8500-prcmu-regs.h mfd: db8500-prcmu: Rename register header 2021-08-05 14:19:59 +01:00
db8500-prcmu.c - Core Frameworks 2021-09-07 12:38:59 -07:00
dln2.c mfd: dln2: Fix double put in dln2_probe 2023-11-20 11:08:24 +01:00
dm355evm_msp.c
…
ene-kb3930.c mfd: ene-kb3930: Make local symbol 'kb3930_power_off' static 2021-04-14 16:03:30 +01:00
exynos-lpass.c
…
ezx-pcap.c
…
fsl-imx25-tsadc.c mfd: fsl-imx25: Fix check for platform_get_irq() errors 2022-10-26 12:35:18 +02:00
gateworks-gsc.c mfd: gateworks-gsc: Fix interrupt type 2021-02-08 13:54:14 +00:00
hi655x-pmic.c mfd: hisilicon: Use the correct HiSilicon copyright 2021-06-02 10:50:04 +01:00
hi6421-pmic-core.c
…
hi6421-spmi-pmic.c mfd: hi6421-spmi-pmic: move driver from staging 2021-07-23 10:13:27 +02:00
htc-i2cpld.c
…
htc-pasic3.c
…
intel-lpss-acpi.c mfd: intel-lpss: Add missing check for platform_get_resource 2023-07-23 13:47:25 +02:00
intel-lpss-pci.c mfd: intel-lpss: Add Intel Alder Lake-M PCI IDs 2021-06-02 10:49:58 +01:00
intel-lpss.c mfd: intel-lpss: Fix the fractional clock divider flags 2024-01-25 14:52:50 -08:00
intel-lpss.h mfd: intel-lpss: Switch to use the software nodes 2021-04-14 16:06:11 +01:00
intel-m10-bmc.c mfd: intel-m10-bmc: Add N5010 variant 2021-07-16 08:55:32 +01:00
intel_pmc_bxt.c
…
intel_pmt.c mfd: intel_pmt: Add support for DG1 2021-03-10 10:48:48 +00:00
intel_quark_i2c_gpio.c mfd: intel_quark_i2c_gpio: Convert GPIO to use software nodes 2021-08-11 16:00:53 +03:00
intel_soc_pmic_bxtwc.c mfd: intel_soc_pmic_bxtwc: Use DEVICE_ATTR_ADMIN_RW macro 2021-06-15 13:14:45 +01:00
intel_soc_pmic_chtdc_ti.c
…
intel_soc_pmic_chtwc.c
…
intel_soc_pmic_core.c mfd: intel_soc_pmic: Fix an error handling path in intel_soc_pmic_i2c_probe() 2022-10-26 12:35:17 +02:00
intel_soc_pmic_core.h
…
intel_soc_pmic_crc.c
…
intel_soc_pmic_mrfld.c
…
ioc3.c mfd: Bulk conversion to generic_handle_domain_irq() 2021-08-12 11:39:39 +01:00
ipaq-micro.c mfd: ipaq-micro: Fix error check return value of platform_get_irq() 2022-06-09 10:23:07 +02:00
iqs62x.c firmware: replace HOTPLUG with UEVENT in FW_ACTION defines 2021-05-13 16:14:45 +02:00
janz-cmodio.c mfd: janz-cmodio: Use DEVICE_ATTR_RO macro 2021-06-15 13:14:23 +01:00
kempld-core.c mfd: kempld-core: Use DEVICE_ATTR_RO macro 2021-06-15 13:13:54 +01:00
khadas-mcu.c
…
lm3533-core.c mfd: lm3533: Switch to using the new API kobj_to_dev() 2021-04-14 16:03:35 +01:00
lm3533-ctrlbank.c
…
lochnagar-i2c.c
…
lp873x.c
…
lp3943.c
…
lp8788-irq.c mfd: lp8788: Fix an error handling path in lp8788_irq_init() and lp8788_irq_init() 2022-10-26 12:35:18 +02:00
lp8788.c mfd: lp8788: Fix an error handling path in lp8788_probe() 2022-10-26 12:35:17 +02:00
lp87565.c mfd: lp87565: Handle optional reset pin 2021-06-02 10:50:00 +01:00
lpc_ich.c mtd: spi-nor: intel-spi: Disable write protection only if asked 2022-11-26 09:24:32 +01:00
lpc_sch.c mfd: lpc_sch: Rename GPIOBASE to prevent build error 2021-09-07 08:44:07 +01:00
madera-core.c
…
madera-i2c.c
…
madera-spi.c
…
madera.h
…
max8907.c mfd: max8907: Remove IRQF_NO_AUTOEN flag 2021-06-15 13:18:58 +01:00
max8925-core.c
…
max8925-i2c.c
…
max8997-irq.c
…
max8997.c mfd: max8997: Simplify getting of_device_id match data 2021-06-02 10:51:17 +01:00
max8998-irq.c
…
max8998.c mfd: max8998: Simplify getting of_device_id match data 2021-06-02 10:51:17 +01:00
max14577.c
…
max77620.c mfd: max77620: Fix refcount leak in max77620_initialise_fps 2022-08-17 14:24:09 +02:00
max77650.c
…
max77686.c
…
max77693.c
…
max77843.c
…
mc13xxx-core.c mfd: mc13xxx: Add check for mc13xxx_irq_request 2022-04-08 14:23:38 +02:00
mc13xxx-i2c.c
…
mc13xxx-spi.c
…
mc13xxx.h
…
mcp-core.c bus: Make remove callback return void 2021-07-21 11:53:42 +02:00
mcp-sa11x0.c mfd: mcp-sa11x0: Use DIV_ROUND_UP to calculate rw_timeout 2021-02-08 13:54:10 +00:00
menelaus.c
…
menf21bmc.c
…
mfd-core.c mfd: core: Ensure disabled devices are skipped without aborting 2023-11-20 11:08:24 +01:00
motorola-cpcap.c mfd: cpcap: Add SPI device ID table 2021-11-18 19:17:08 +01:00
mp2629.c
…
mt6358-irq.c mfd: Add support for the MediaTek MT6359 PMIC 2021-06-01 16:44:23 +01:00
mt6360-core.c mfd: mt6360: Add bounds checking in Regmap read/write call-backs 2023-01-12 11:58:47 +01:00
mt6397-core.c mfd: mt6397: Add PMIC keys for MT6358 2021-06-02 10:49:59 +01:00
mt6397-irq.c
…
mxs-lradc.c
…
ntxec.c mfd: ntxec: Support for EC in Tolino Shine 2 HD 2021-04-14 16:06:29 +01:00
omap-usb-host.c mfd: omap-usb-host: File headers are not good candidates for kernel-doc 2021-06-02 10:50:03 +01:00
omap-usb-tll.c mfd: omap-usb-tll: Use struct_size to allocate tll 2024-08-19 05:45:03 +02:00
omap-usb.h
…
palmas.c
…
pcf50633-adc.c mfd: pcf50633-adc: Fix potential memleak in pcf50633_adc_async_read() 2023-03-10 09:39:34 +01:00
pcf50633-core.c mfd: pcf50633: Use DEVICE_ATTR_ADMIN_RO macro 2021-06-15 13:03:21 +01:00
pcf50633-gpio.c
…
pcf50633-irq.c
…
qcom-pm8xxx.c mfd: Bulk conversion to generic_handle_domain_irq() 2021-08-12 11:39:39 +01:00
qcom-pm8008.c mfd: pm8008: Fix module autoloading 2023-07-23 13:47:51 +02:00
qcom-spmi-pmic.c
…
qcom_rpm.c mfd: qcom_rpm: Use devm_of_platform_populate() to simplify code 2022-12-31 13:14:48 +01:00
rave-sp.c
…
rc5t583-irq.c
…
rc5t583.c
…
rdc321x-southbridge.c
…
retu-mfd.c
…
rk808.c mfd: Add Rockchip rk817 audio CODEC support 2021-06-01 13:40:23 +01:00
rn5t618.c mfd: rn5t618: Fix IRQ trigger by changing it to level mode 2021-06-02 10:50:00 +01:00
rohm-bd718x7.c mfd: bd718x7: simplify by cleaning unnecessary device data 2021-04-14 10:17:53 +01:00
rohm-bd9576.c mfd: bd9576: Add IRQ support 2021-03-10 10:58:33 +00:00
rohm-bd70528.c
…
rohm-bd71828.c mfd: Support for ROHM BD71815 PMIC core 2021-04-14 10:19:08 +01:00
rsmu.h mfd: Add Renesas Synchronization Management Unit (SMU) support 2021-07-13 12:20:44 +01:00
rsmu_core.c mfd: rsmu: Split core code into separate module 2024-08-19 05:45:02 +02:00
rsmu_i2c.c mfd: Add Renesas Synchronization Management Unit (SMU) support 2021-07-13 12:20:44 +01:00
rsmu_spi.c mfd: Add Renesas Synchronization Management Unit (SMU) support 2021-07-13 12:20:44 +01:00
rt4831.c mfd: rt4831: Adds support for Richtek RT4831 2021-06-02 10:50:01 +01:00
rt5033.c mfd: rt5033: Drop rt5033-battery sub-device 2023-07-23 13:47:24 +02:00
sec-core.c mfd: sec: Enable wakeup from suspend via devicetree property 2021-06-02 10:51:18 +01:00
sec-irq.c mfd: sec: Remove unused irq_base in platform data 2021-06-02 10:51:18 +01:00
si476x-cmd.c mfd: si476x-cmd: Fix a bunch of incorrectly documented function names 2021-06-02 10:50:04 +01:00
si476x-i2c.c mfd: si476x-i2c: Fix incorrectly documented function names 2021-06-02 10:50:04 +01:00
si476x-prop.c
…
simple-mfd-i2c.c mfd: simple-mfd-i2c: Add support for registering devices via MFD cells 2021-08-16 13:45:34 +01:00
simple-mfd-i2c.h mfd: simple-mfd-i2c: Add support for registering devices via MFD cells 2021-08-16 13:45:34 +01:00
sky81452.c
…
sm501.c mfd: sm501: Add check for platform_driver_register() 2022-10-26 12:35:18 +02:00
sprd-sc27xx-spi.c mfd: sprd: Add SPI device ID table 2021-11-18 19:17:09 +01:00
ssbi.c
…
sta2x11-mfd.c
…
stm32-lptimer.c
…
stm32-timers.c mfd: stm32-timers: Avoid clearing auto reload register 2021-04-14 16:06:26 +01:00
stmfx.c mfd: stmfx: Nullify stmfx->vdd in case of error 2023-07-23 13:47:26 +02:00
stmpe-i2c.c mfd: da9052/stmpe: Add and modify MODULE_DEVICE_TABLE 2021-06-02 10:50:00 +01:00
stmpe-spi.c
…
stmpe.c mfd: stmpe: Only disable the regulators if they are enabled 2023-07-23 13:47:26 +02:00
stmpe.h
…
stpmic1.c
…
stw481x.c
…
sun4i-gpadc.c
…
sun6i-prcm.c mfd: sun6i-prcm: Use DEFINE_RES_MEM() to simplify code 2021-06-02 10:51:19 +01:00
syscon.c mfd: syscon: Call of_node_put() only when of_parse_phandle() takes a ref 2024-03-26 18:21:29 -04:00
t7l66xb.c mfd: t7l66xb: Drop platform disable callback 2022-08-17 14:24:09 +02:00
tc3589x.c mfd: Don't use irq_create_mapping() to resolve a mapping 2021-08-05 12:41:06 +01:00
tc6387xb.c
…
tc6393xb.c
…
ti-lmu.c
…
ti_am335x_tscadc.c mfd: ti_am335x_tscadc: Delete superfluous error message 2021-08-16 14:03:22 +01:00
timberdale.c mfd: timberdale: Use DEVICE_ATTR_RO macro 2021-06-15 13:02:18 +01:00
timberdale.h
…
tmio_core.c
…
tps6105x.c
…
tps6507x.c
…
tps6586x.c
…
tps65010.c
…
tps65086.c mfd: tps65086: Add cell entry for reset driver 2021-08-16 13:40:54 +01:00
tps65090.c
…
tps65217.c
…
tps65218.c
…
tps65910.c mfd: tps65910: Set PWR_OFF bit during driver probe 2022-01-27 11:05:07 +01:00
tps65911-comparator.c
…
tps65912-core.c
…
tps65912-i2c.c
…
tps65912-spi.c
…
tps80031.c mfd: tps80031: Use DEFINE_RES_IRQ() to simplify code 2021-06-02 10:51:19 +01:00
tqmx86.c mfd: tqmx86: Correct board names for TQMxE39x 2023-05-11 23:00:38 +09:00
twl-core.c mfd: twl-core: Fix incorrect function name twl_regcache_bypass() 2021-06-02 10:50:03 +01:00
twl-core.h
…
twl4030-audio.c
…
twl4030-irq.c
…
twl4030-power.c
…
twl6030-irq.c
…
twl6040.c
…
ucb1x00-assabet.c mfd: ucb1x00-assabet: Use DEVICE_ATTR_RO macro 2021-06-15 13:02:01 +01:00
ucb1x00-core.c
…
ucb1x00-ts.c
…
ucb1400_core.c
…
vexpress-sysreg.c
…
viperboard.c
…
vx855.c
…
wcd934x.c mfd: wcd934x: Add additional interrupts required for MBHC support 2021-06-02 10:49:59 +01:00
wl1273-core.c
…
wm97xx-core.c
…
wm831x-auxadc.c mfd: wm831x-auxadc: Prevent use after free in wm831x_auxadc_read_irq() 2021-02-08 13:54:40 +00:00
wm831x-core.c mfd: wm831x: Use DEFINE_RES_IRQ_NAMED() and DEFINE_RES_IRQ() to simplify code 2021-06-15 12:53:38 +01:00
wm831x-i2c.c
…
wm831x-irq.c
…
wm831x-otp.c mfd: wm831x: Use DEVICE_ATTR_RO macro 2021-06-15 13:01:45 +01:00
wm831x-spi.c
…
wm5102-tables.c
…
wm5110-tables.c
…
wm8350-core.c
…
wm8350-gpio.c
…
wm8350-i2c.c
…
wm8350-irq.c
…
wm8350-regmap.c
…
wm8400-core.c
…
wm8994-core.c
…
wm8994-irq.c mfd: Don't use irq_create_mapping() to resolve a mapping 2021-08-05 12:41:06 +01:00
wm8994-regmap.c
…
wm8994.h
…
wm8997-tables.c
…
wm8998-tables.c
…