Skip to content

Commit 779c592

Browse files
ausyskinmiquelraynal
authored andcommitted
mtd: intel-dg: Fix accessing regions before setting nregions
The regions array is counted by nregions, but it's set only after accessing it: [] UBSAN: array-index-out-of-bounds in drivers/mtd/devices/mtd_intel_dg.c:750:15 [] index 0 is out of range for type '<unknown> [*]' Fix it by also fixing an undesired behavior: the loop silently ignores ENOMEM and continues setting the other entries. CC: Gustavo A. R. Silva <gustavoars@kernel.org> CC: Raag Jadav <raag.jadav@intel.com> Reported-by: Jani Partanen <jiipee@sotapeli.fi> Closes: https://lore.kernel.org/all/caca6c67-4f1d-49f1-948f-e63b6b937b29@sotapeli.fi Fixes: ceb5ab3 ("mtd: add driver for intel graphics non-volatile memory device") Signed-off-by: Lucas De Marchi <demarchi@kernel.org> Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com> Reviewed-by: Raag Jadav <raag.jadav@intel.com> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
1 parent 9054127 commit 779c592

1 file changed

Lines changed: 6 additions & 3 deletions

File tree

drivers/mtd/devices/mtd_intel_dg.c

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -770,20 +770,23 @@ static int intel_dg_mtd_probe(struct auxiliary_device *aux_dev,
770770

771771
kref_init(&nvm->refcnt);
772772
mutex_init(&nvm->lock);
773+
nvm->nregions = nregions;
773774

774775
for (n = 0, i = 0; i < INTEL_DG_NVM_REGIONS; i++) {
775776
if (!invm->regions[i].name)
776777
continue;
777778

778779
char *name = kasprintf(GFP_KERNEL, "%s.%s",
779780
dev_name(&aux_dev->dev), invm->regions[i].name);
780-
if (!name)
781-
continue;
781+
if (!name) {
782+
ret = -ENOMEM;
783+
goto err;
784+
}
785+
782786
nvm->regions[n].name = name;
783787
nvm->regions[n].id = i;
784788
n++;
785789
}
786-
nvm->nregions = n; /* in case where kasprintf fail */
787790

788791
ret = devm_pm_runtime_enable(device);
789792
if (ret < 0) {

0 commit comments

Comments
 (0)