On Monday 24 April 2017 08:34:08 Pan Bian wrote: > Function devm_kzalloc() will return a NULL pointer. However, in function > isp1704_charger_probe(), the return value of devm_kzalloc() is directly > used without validation. This may result in a bad memory access bug. > > Signed-off-by: Pan Bian <[email protected]> > --- > drivers/power/supply/isp1704_charger.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/drivers/power/supply/isp1704_charger.c > b/drivers/power/supply/isp1704_charger.c > index 4cd6899..2f02463 100644 > --- a/drivers/power/supply/isp1704_charger.c > +++ b/drivers/power/supply/isp1704_charger.c > @@ -418,6 +418,8 @@ static int isp1704_charger_probe(struct platform_device > *pdev) > > pdata = devm_kzalloc(&pdev->dev, > sizeof(struct isp1704_charger_data), GFP_KERNEL); > + if (pdata) > + goto fail0; > pdata->enable_gpio = gpio; > > dev_info(&pdev->dev, "init gpio %d\n", pdata->enable_gpio);
fail0 returns ret value value which is initialized to -ENODEV. It could be fragile if somebody change default initialization ret value to something else (wort to 0). In your case before goto fail0 it is needed to explicitly set ret to -ENOMEM so prevent future problems. -- Pali Rohár [email protected]
