linux-kernel - Re: [PATCH v2] regulator: tps65219: Fix devm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250627193150.nxer4zuowaejzp4v@unarmored>
Date: Fri, 27 Jun 2025 14:31:50 -0500
From: Nishanth Menon <nm@...com>
To: Shree Ramamoorthy <s-ramamoorthy@...com>
CC: <aaro.koskinen@....fi>, <andreas@...nade.info>, <khilman@...libre.com>,
        <rogerq@...nel.org>, <tony@...mide.com>, <lee@...nel.org>,
        <d-gole@...com>, <robertcnelson@...il.com>, <jkridner@...il.com>,
        <linux-omap@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
        <m-leonard@...com>, <praneeth@...com>, <afd@...com>
Subject: Re: [PATCH v2] regulator: tps65219: Fix devm_kmalloc size allocation

On 10:45-20250620, Shree Ramamoorthy wrote:
> In probe(), two arrays of structs are allocated with the devm_kmalloc()
> function, but the memory size of the allocations were given as the arrays'
> length (pmic->common_irq_size for the first call and pmic->dev_irq_size for
> the second devm_kmalloc call). The memory size should have been the total
> memory needed.
> 
> This led to a heap overflow when the struct array was used. The issue was
> first discovered with the PocketBeagle2 and BeaglePlay. The common and
> device-specific structs are now allocated one at a time within the loop.
> 
> Fixes: 38c9f98db20a ("regulator: tps65219: Add support for TPS65215 Regulator IRQs")
> Reported-by: Dhruva Gole <d-gole@...com>
> Closes: https://lore.kernel.org/all/20250619153526.297398-1-d-gole@ti.com/
> Tested-by: Robert Nelson <robertcnelson@...il.com>
> Acked-by: Andrew Davis <afd@...com>
> Signed-off-by: Shree Ramamoorthy <s-ramamoorthy@...com>
> ---
> v2: Update commit message explanation & tags.
> ---

Kasan also reports the same on latest next :(
https://gist.github.com/nmenon/a0a020e8417c198d2f366fa00b900e12

Could this be routed to master please?

Reviewed-by: Nishanth Menon <nm@...com>

>  drivers/regulator/tps65219-regulator.c | 28 +++++++++++++-------------
>  1 file changed, 14 insertions(+), 14 deletions(-)
> 
> diff --git a/drivers/regulator/tps65219-regulator.c b/drivers/regulator/tps65219-regulator.c
> index b16b300d7f45..5e67fdc88f49 100644
> --- a/drivers/regulator/tps65219-regulator.c
> +++ b/drivers/regulator/tps65219-regulator.c
> @@ -436,46 +436,46 @@ static int tps65219_regulator_probe(struct platform_device *pdev)
>  					     pmic->rdesc[i].name);
>  	}
>  
> -	irq_data = devm_kmalloc(tps->dev, pmic->common_irq_size, GFP_KERNEL);
> -	if (!irq_data)
> -		return -ENOMEM;
> -
>  	for (i = 0; i < pmic->common_irq_size; ++i) {
>  		irq_type = &pmic->common_irq_types[i];
>  		irq = platform_get_irq_byname(pdev, irq_type->irq_name);
>  		if (irq < 0)
>  			return -EINVAL;
>  
> -		irq_data[i].dev = tps->dev;
> -		irq_data[i].type = irq_type;
> +		irq_data = devm_kmalloc(tps->dev, sizeof(*irq_data), GFP_KERNEL);
> +		if (!irq_data)
> +			return -ENOMEM;
> +
> +		irq_data->dev = tps->dev;
> +		irq_data->type = irq_type;
>  		error = devm_request_threaded_irq(tps->dev, irq, NULL,
>  						  tps65219_regulator_irq_handler,
>  						  IRQF_ONESHOT,
>  						  irq_type->irq_name,
> -						  &irq_data[i]);
> +						  irq_data);
>  		if (error)
>  			return dev_err_probe(tps->dev, PTR_ERR(rdev),
>  					     "Failed to request %s IRQ %d: %d\n",
>  					     irq_type->irq_name, irq, error);
>  	}
>  
> -	irq_data = devm_kmalloc(tps->dev, pmic->dev_irq_size, GFP_KERNEL);
> -	if (!irq_data)
> -		return -ENOMEM;
> -
>  	for (i = 0; i < pmic->dev_irq_size; ++i) {
>  		irq_type = &pmic->irq_types[i];
>  		irq = platform_get_irq_byname(pdev, irq_type->irq_name);
>  		if (irq < 0)
>  			return -EINVAL;
>  
> -		irq_data[i].dev = tps->dev;
> -		irq_data[i].type = irq_type;
> +		irq_data = devm_kmalloc(tps->dev, sizeof(*irq_data), GFP_KERNEL);
> +		if (!irq_data)
> +			return -ENOMEM;
> +
> +		irq_data->dev = tps->dev;
> +		irq_data->type = irq_type;
>  		error = devm_request_threaded_irq(tps->dev, irq, NULL,
>  						  tps65219_regulator_irq_handler,
>  						  IRQF_ONESHOT,
>  						  irq_type->irq_name,
> -						  &irq_data[i]);
> +						  irq_data);
>  		if (error)
>  			return dev_err_probe(tps->dev, PTR_ERR(rdev),
>  					     "Failed to request %s IRQ %d: %d\n",
> 
> base-commit: 75f5f23f8787c5e184fcb2fbcd02d8e9317dc5e7
> -- 
> 2.43.0
> 
> 

-- 
Regards,
Nishanth Menon
Key (0xDDB5849D1736249D) / Fingerprint: F8A2 8693 54EB 8232 17A3  1A34 DDB5 849D 1736 249D