From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753499AbdLMQZi (ORCPT ); Wed, 13 Dec 2017 11:25:38 -0500 Received: from mail-wr0-f195.google.com ([209.85.128.195]:35853 "EHLO mail-wr0-f195.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752292AbdLMQZf (ORCPT ); Wed, 13 Dec 2017 11:25:35 -0500 X-Google-Smtp-Source: ACJfBovIImJUvcStHRM7ByJfNqlifk/U249u9TwXx9nkZ9fxbn8XsenS/9yD68XSnN71qhQYzUS4cA== From: Bartosz Golaszewski To: Mark Brown , Greg Kroah-Hartman Cc: linux-kernel@vger.kernel.org, Lars-Peter Clausen , Andy Shevchenko , Bartosz Golaszewski Subject: [PATCH v2] regmap: potentially duplicate the name string stored in regmap Date: Wed, 13 Dec 2017 17:25:31 +0100 Message-Id: <20171213162531.29531-1-brgl@bgdev.pl> X-Mailer: git-send-email 2.15.1 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Currently we just copy over the pointer passed to regmap_init() in the regmap config struct. To be on the safe side: duplicate the string with kstrdup_const() so that if an unaware user passes an address to a stack-allocated buffer, we won't crash. Signed-off-by: Bartosz Golaszewski --- v1 -> v2: - drop the patches that were either applied or done by Mark - fix an error path - use kstrdup_const() instead of kstrdup() to avoid unnecessary memory allocations drivers/base/regmap/regmap.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c index 16a66ba84aef..bd62600b40e4 100644 --- a/drivers/base/regmap/regmap.c +++ b/drivers/base/regmap/regmap.c @@ -672,6 +672,14 @@ struct regmap *__regmap_init(struct device *dev, goto err; } + if (config->name) { + map->name = kstrdup_const(config->name, GFP_KERNEL); + if (!map->name) { + ret = -ENOMEM; + goto err_map; + } + } + if (config->disable_locking) { map->lock = map->unlock = regmap_lock_unlock_none; } else if (config->lock && config->unlock) { @@ -682,7 +690,7 @@ struct regmap *__regmap_init(struct device *dev, map->hwlock = hwspin_lock_request_specific(config->hwlock_id); if (!map->hwlock) { ret = -ENXIO; - goto err_map; + goto err_name; } switch (config->hwlock_mode) { @@ -762,7 +770,6 @@ struct regmap *__regmap_init(struct device *dev, map->volatile_reg = config->volatile_reg; map->precious_reg = config->precious_reg; map->cache_type = config->cache_type; - map->name = config->name; spin_lock_init(&map->async_lock); INIT_LIST_HEAD(&map->async_list); @@ -1118,6 +1125,8 @@ struct regmap *__regmap_init(struct device *dev, err_hwlock: if (map->hwlock) hwspin_lock_free(map->hwlock); +err_name: + kfree_const(map->name); err_map: kfree(map); err: @@ -1307,6 +1316,7 @@ void regmap_exit(struct regmap *map) } if (map->hwlock) hwspin_lock_free(map->hwlock); + kfree_const(map->name); kfree(map); } EXPORT_SYMBOL_GPL(regmap_exit); -- 2.15.1