linux-kernel - Re: [PATCH] pinctrl: mediatek: make devm allocations safer and clearer in mtk_eint_do

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAD++jLmHWkmOm9nNbchNNoWG=TYPs3nZmB-fUEwb6fuspiTd7A@mail.gmail.com>
Date: Fri, 26 Dec 2025 19:14:55 +0100
From: Linus Walleij <linusw@...nel.org>
To: Liang Jie <buaajxlj@....com>
Cc: Sean Wang <sean.wang@...nel.org>, Linus Walleij <linus.walleij@...aro.org>, 
	Matthias Brugger <matthias.bgg@...il.com>, 
	AngeloGioacchino Del Regno <angelogioacchino.delregno@...labora.com>, 
	"moderated list:PIN CONTROLLER - MEDIATEK" <linux-mediatek@...ts.infradead.org>, 
	"open list:PIN CONTROL SUBSYSTEM" <linux-gpio@...r.kernel.org>, 
	"open list:ARM/Mediatek SoC support" <linux-kernel@...r.kernel.org>, 
	"moderated list:ARM/Mediatek SoC support" <linux-arm-kernel@...ts.infradead.org>, liangjie@...iang.com, 
	fanggeng <fanggeng@...iang.com>
Subject: Re: [PATCH] pinctrl: mediatek: make devm allocations safer and
 clearer in mtk_eint_do_init()

On Tue, Dec 9, 2025 at 11:03 AM Liang Jie <buaajxlj@....com> wrote:

> From: Liang Jie <liangjie@...iang.com>
>
> mtk_eint_do_init() allocates several pointer arrays which are then
> populated in a per-instance loop and freed on error. The arrays are
> currently allocated with devm_kmalloc(), so their entries are left
> uninitialised until the per-instance allocations succeed.
>
> On a failure in the middle of the loop, the error path iterates over
> the full nbase range and calls devm_kfree() on each element. For
> indices which were never initialised, the corresponding array entries
> contain stack garbage. If any of those happen to be non-zero,
> devm_kfree() will pass them to devres_destroy(), which will WARN
> because there is no matching devm_kmalloc() resource for such bogus
> pointers.
>
> Improve the robustness and readability by:
>
>   - Using devm_kcalloc() for the pointer arrays so that all entries
>     start as NULL, ensuring that only genuinely initialised elements
>     may be freed and preventing spurious WARN_ON()s in the error path.
>   - Switching the allocations to sizeof(*ptr) / sizeof(**ptr) forms,
>     avoiding hard-coded element types and making the code more resilient
>     to future type changes.
>   - Dropping the redundant NULL checks before devm_kfree(), as
>     devm_kfree() safely handles NULL pointers.
>
> The functional behaviour in the successful initialisation path remains
> unchanged, while the error handling becomes simpler and less
> error-prone.
>
> Reviewed-by: fanggeng <fanggeng@...iang.com>
> Signed-off-by: Liang Jie <liangjie@...iang.com>

This looks reasonable to me, so patch applied.

Yours,
Linus Walleij