[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <20240620-omap-usb-tll-counted_by-v1-2-77797834bb9a@gmail.com>
Date: Thu, 20 Jun 2024 23:22:34 +0200
From: Javier Carrasco <javier.carrasco.cruz@...il.com>
To: Tony Lindgren <tony@...mide.com>, Lee Jones <lee@...nel.org>,
Kees Cook <kees@...nel.org>, "Gustavo A. R. Silva" <gustavoars@...nel.org>
Cc: linux-omap@...r.kernel.org, linux-kernel@...r.kernel.org,
linux-hardening@...r.kernel.org,
Javier Carrasco <javier.carrasco.cruz@...il.com>
Subject: [PATCH 2/2] mfd: omap-usb-tll: use struct_size to allocate tll
Use the struct_size macro to calculate the size of the tll, which
includes a trailing flexible array.
Signed-off-by: Javier Carrasco <javier.carrasco.cruz@...il.com>
---
The memory allocation used to be carried out in two steps:
tll = devm_kzalloc(dev, sizeof(struct usbtll_omap), GFP_KERNEL);
tll->ch_clk = devm_kzalloc(dev, sizeof(struct clk *) * tll->nch,
GFP_KERNEL);
Until commit 16c2004d9e4d ("mfd: omap-usb-tll: Allocate driver data at once")
turned that into the current allocation:
tll = devm_kzalloc(dev, sizeof(*tll) + sizeof(tll->ch_clk[nch]),
GFP_KERNEL);
That has surprised me at first glance because I would have expected
sizeof(tll->ch_clk[nch]) to return the size of a single pointer, not
being equivalent to 'sizeof(struct clk *) * nch'.
I might be missing/misunderstanding something here because the commit
is not new, and the error should be noticeable. Moreover, I don't have
real hardware to test it. Hence why I didn't mark this patch as a fix.
I would be pleased to get feedback about this (why it is right as it is,
or if that is actually a bug).
---
drivers/mfd/omap-usb-tll.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/mfd/omap-usb-tll.c b/drivers/mfd/omap-usb-tll.c
index a091e5b0f21d..5f25ac514ff2 100644
--- a/drivers/mfd/omap-usb-tll.c
+++ b/drivers/mfd/omap-usb-tll.c
@@ -230,8 +230,7 @@ static int usbtll_omap_probe(struct platform_device *pdev)
break;
}
- tll = devm_kzalloc(dev, sizeof(*tll) + sizeof(tll->ch_clk[nch]),
- GFP_KERNEL);
+ tll = devm_kzalloc(dev, struct_size(tll, ch_clk, nch), GFP_KERNEL);
if (!tll) {
pm_runtime_put_sync(dev);
pm_runtime_disable(dev);
--
2.40.1
Powered by blists - more mailing lists