Re: [PATCH v2] regulator: tps65219: Fix devm_kmalloc size allocation

[Shree Ramamoorthy <s-ramamoorthy@ti.com>]

+Mark. Sorry, missed cc'ing you on this series!

On 6/27/2025 2:31 PM, Nishanth Menon wrote:
> On 10:45-20250620, Shree Ramamoorthy wrote:
>> In probe(), two arrays of structs are allocated with the devm_kmalloc()
>> function, but the memory size of the allocations were given as the arrays'
>> length (pmic->common_irq_size for the first call and pmic->dev_irq_size for
>> the second devm_kmalloc call). The memory size should have been the total
>> memory needed.
>>
>> This led to a heap overflow when the struct array was used. The issue was
>> first discovered with the PocketBeagle2 and BeaglePlay. The common and
>> device-specific structs are now allocated one at a time within the loop.
>>
>> Fixes: 38c9f98db20a ("regulator: tps65219: Add support for TPS65215 Regulator IRQs")
>> Reported-by: Dhruva Gole <d-gole@ti.com>
>> Closes: https://lore.kernel.org/all/20250619153526.297398-1-d-gole@ti.com/
>> Tested-by: Robert Nelson <robertcnelson@gmail.com>
>> Acked-by: Andrew Davis <afd@ti.com>
>> Signed-off-by: Shree Ramamoorthy <s-ramamoorthy@ti.com>
>> ---
>> v2: Update commit message explanation & tags.
>> ---
> Kasan also reports the same on latest next :(
> https://gist.github.com/nmenon/a0a020e8417c198d2f366fa00b900e12
>
> Could this be routed to master please?
>
> Reviewed-by: Nishanth Menon <nm@ti.com>
>
>>  drivers/regulator/tps65219-regulator.c | 28 +++++++++++++-------------
>>  1 file changed, 14 insertions(+), 14 deletions(-)
>>
>> diff --git a/drivers/regulator/tps65219-regulator.c b/drivers/regulator/tps65219-regulator.c
>> index b16b300d7f45..5e67fdc88f49 100644
>> --- a/drivers/regulator/tps65219-regulator.c
>> +++ b/drivers/regulator/tps65219-regulator.c
>> @@ -436,46 +436,46 @@ static int tps65219_regulator_probe(struct platform_device *pdev)
>>  					     pmic->rdesc[i].name);
>>  	}
>>  
>> -	irq_data = devm_kmalloc(tps->dev, pmic->common_irq_size, GFP_KERNEL);
>> -	if (!irq_data)
>> -		return -ENOMEM;
>> -
>>  	for (i = 0; i < pmic->common_irq_size; ++i) {
>>  		irq_type = &pmic->common_irq_types[i];
>>  		irq = platform_get_irq_byname(pdev, irq_type->irq_name);
>>  		if (irq < 0)
>>  			return -EINVAL;
>>  
>> -		irq_data[i].dev = tps->dev;
>> -		irq_data[i].type = irq_type;
>> +		irq_data = devm_kmalloc(tps->dev, sizeof(*irq_data), GFP_KERNEL);
>> +		if (!irq_data)
>> +			return -ENOMEM;
>> +
>> +		irq_data->dev = tps->dev;
>> +		irq_data->type = irq_type;
>>  		error = devm_request_threaded_irq(tps->dev, irq, NULL,
>>  						  tps65219_regulator_irq_handler,
>>  						  IRQF_ONESHOT,
>>  						  irq_type->irq_name,
>> -						  &irq_data[i]);
>> +						  irq_data);
>>  		if (error)
>>  			return dev_err_probe(tps->dev, PTR_ERR(rdev),
>>  					     "Failed to request %s IRQ %d: %d\n",
>>  					     irq_type->irq_name, irq, error);
>>  	}
>>  
>> -	irq_data = devm_kmalloc(tps->dev, pmic->dev_irq_size, GFP_KERNEL);
>> -	if (!irq_data)
>> -		return -ENOMEM;
>> -
>>  	for (i = 0; i < pmic->dev_irq_size; ++i) {
>>  		irq_type = &pmic->irq_types[i];
>>  		irq = platform_get_irq_byname(pdev, irq_type->irq_name);
>>  		if (irq < 0)
>>  			return -EINVAL;
>>  
>> -		irq_data[i].dev = tps->dev;
>> -		irq_data[i].type = irq_type;
>> +		irq_data = devm_kmalloc(tps->dev, sizeof(*irq_data), GFP_KERNEL);
>> +		if (!irq_data)
>> +			return -ENOMEM;
>> +
>> +		irq_data->dev = tps->dev;
>> +		irq_data->type = irq_type;
>>  		error = devm_request_threaded_irq(tps->dev, irq, NULL,
>>  						  tps65219_regulator_irq_handler,
>>  						  IRQF_ONESHOT,
>>  						  irq_type->irq_name,
>> -						  &irq_data[i]);
>> +						  irq_data);
>>  		if (error)
>>  			return dev_err_probe(tps->dev, PTR_ERR(rdev),
>>  					     "Failed to request %s IRQ %d: %d\n",
>>
>> base-commit: 75f5f23f8787c5e184fcb2fbcd02d8e9317dc5e7
>> -- 
>> 2.43.0
>>
>>