lkml.org 
[lkml]   [2022]   [Jun]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.18 328/879] regulator: da9121: Fix uninit-value in da9121_assign_chip_model()
    Date
    From: Wei Yongjun <weiyongjun1@huawei.com>

    [ Upstream commit bab76514aca36bc513224525d5598da676938218 ]

    KASAN report slab-out-of-bounds in __regmap_init as follows:

    BUG: KASAN: slab-out-of-bounds in __regmap_init drivers/base/regmap/regmap.c:841
    Read of size 1 at addr ffff88803678cdf1 by task xrun/9137

    CPU: 0 PID: 9137 Comm: xrun Tainted: G W 5.18.0-rc2
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
    Call Trace:
    <TASK>
    dump_stack_lvl+0xe8/0x15a lib/dump_stack.c:88
    print_report.cold+0xcd/0x69b mm/kasan/report.c:313
    kasan_report+0x8e/0xc0 mm/kasan/report.c:491
    __regmap_init+0x4540/0x4ba0 drivers/base/regmap/regmap.c:841
    __devm_regmap_init+0x7a/0x100 drivers/base/regmap/regmap.c:1266
    __devm_regmap_init_i2c+0x65/0x80 drivers/base/regmap/regmap-i2c.c:394
    da9121_i2c_probe+0x386/0x6d1 drivers/regulator/da9121-regulator.c:1039
    i2c_device_probe+0x959/0xac0 drivers/i2c/i2c-core-base.c:563

    This happend when da9121 device is probe by da9121_i2c_id, but with
    invalid dts. Thus, chip->subvariant_id is set to -EINVAL, and later
    da9121_assign_chip_model() will access 'regmap' without init it.

    Fix it by return -EINVAL from da9121_assign_chip_model() if
    'chip->subvariant_id' is invalid.

    Fixes: f3fbd5566f6a ("regulator: da9121: Add device variants")
    Reported-by: Hulk Robot <hulkci@huawei.com>
    Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
    Reviewed-by: Adam Ward <Adam.Ward.Opensource@diasemi.com>
    Link: https://lore.kernel.org/r/20220421090335.1876149-1-weiyongjun1@huawei.com
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/regulator/da9121-regulator.c | 2 ++
    1 file changed, 2 insertions(+)

    diff --git a/drivers/regulator/da9121-regulator.c b/drivers/regulator/da9121-regulator.c
    index eb9df485bd8a..76e0e23bf598 100644
    --- a/drivers/regulator/da9121-regulator.c
    +++ b/drivers/regulator/da9121-regulator.c
    @@ -1030,6 +1030,8 @@ static int da9121_assign_chip_model(struct i2c_client *i2c,
    chip->variant_id = DA9121_TYPE_DA9142;
    regmap = &da9121_2ch_regmap_config;
    break;
    + default:
    + return -EINVAL;
    }

    /* Set these up for of_regulator_match call which may want .of_map_modes */
    --
    2.35.1


    \
     
     \ /
      Last update: 2022-06-08 00:43    [W:4.048 / U:0.020 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site