Commit 53ce4d4a authored Jul 06, 2017 by Gustavo A. R. Silva Committed by Greg Kroah-Hartman Dec 10, 2017

iio: multiplexer: add NULL check on devm_kzalloc() and devm_kmemdup() return values




[ Upstream commit dd92d5ea20ef8a42be7aeda08c669c586c730451 ]

Check return values from call to devm_kzalloc() and devm_kmemup()
in order to prevent a NULL pointer dereference.

This issue was detected using Coccinelle and the following semantic patch:

@@
expression x;
identifier fld;
@@

* x = devm_kzalloc(...);
   ... when != x == NULL
   x->fld

Fixes: 7ba9df54 ("iio: multiplexer: new iio category and iio-mux driver")
Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com>
Acked-by: Peter Rosin <peda@axentia.se>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent 68744edd

drivers/iio/multiplexer/iio-mux.c

+6 −0

Original line number	Diff line number	Diff line
		@@ -285,6 +285,9 @@ static int mux_configure_channel(struct device dev, struct mux mux,
		child->ext_info_cache = devm_kzalloc(dev,
		sizeof(child->ext_info_cache)
		num_ext_info, GFP_KERNEL);
		if (!child->ext_info_cache)
		return -ENOMEM;

		for (i = 0; i < num_ext_info; ++i) {
		child->ext_info_cache[i].size = -1;

		@@ -309,6 +312,9 @@ static int mux_configure_channel(struct device dev, struct mux mux,

		child->ext_info_cache[i].data = devm_kmemdup(dev, page, ret + 1,
		GFP_KERNEL);
		if (!child->ext_info_cache[i].data)
		return -ENOMEM;

		child->ext_info_cache[i].data[ret] = 0;
		child->ext_info_cache[i].size = ret;
		}