From nobody Sat Apr 11 13:01:16 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 22D35C678D5 for ; Tue, 7 Mar 2023 05:31:56 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230062AbjCGFby (ORCPT ); Tue, 7 Mar 2023 00:31:54 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41866 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229527AbjCGFbw (ORCPT ); Tue, 7 Mar 2023 00:31:52 -0500 X-Greylist: delayed 1811 seconds by postgrey-1.37 at lindbergh.monkeyblade.net; Mon, 06 Mar 2023 21:31:50 PST Received: from m126.mail.126.com (m126.mail.126.com [123.126.96.241]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id 7F88A6B5C3 for ; Mon, 6 Mar 2023 21:31:50 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=126.com; s=s110527; h=From:Subject:Date:Message-Id:MIME-Version; bh=mwbUX KOEJhtts3eLN23hd0BPVEyQqp55SlFwfXBgx4E=; b=OWd6UCelCCTlMbdnKnXXd 9qC6hwK2poYJb3/M3JepDALXlXI31hn27mZ1i/Ui5UmwbVjqrDetuppWCZdAvLfe RjJuQL5ecrmA7LmFlcvnn9HHOVgTjm14P19qHMtQDkaE1gryKtUE53Ss2XZq0PLK j0uVsyNQfM2aGYqVqcMfEs= Received: from localhost.localdomain (unknown [113.91.40.179]) by smtp13 (Coremail) with SMTP id feRpCgCnrkolxQZkYHntBg--.54585S2; Tue, 07 Mar 2023 13:01:27 +0800 (CST) From: Xujun Leng To: gregkh@linuxfoundation.org, rafael@kernel.org Cc: linux-kernel@vger.kernel.org, Xujun Leng Subject: [PATCH] driver core: platform: added arguments check for platform_device_add_resources() Date: Tue, 7 Mar 2023 13:01:16 +0800 Message-Id: <20230307050116.12019-1-lengxujun2007@126.com> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-CM-TRANSID: feRpCgCnrkolxQZkYHntBg--.54585S2 X-Coremail-Antispam: 1Uf129KBjvdXoWrtr1DWFyruw15Xr17JFy5urg_yoWDXFbE9a 10gF1xJr1rCF4kK34jk3W7CrsavFZxWr95WFy3Ka4Sg3y3X3W29ryUWryUJa4UXr10kFyq q3srGr13Z34akjkaLaAFLSUrUUUUUb8apTn2vfkv8UJUUUU8Yxn0WfASr-VFAUDa7-sFnT 9fnUUvcSsGvfC2KfnxnUUI43ZEXa7xRNyxR7UUUUU== X-Originating-IP: [113.91.40.179] X-CM-SenderInfo: pohqw5hxmx0jqqqxqiyswou0bp/1tbikgcrd1pEJy-g7QAAsS Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" In the follow two cases, platform_device_add_resources() can lead an invalid address access: 1) If (!res && num > 0), pdev->resource will be set to NULL but pdev->num_resources > 0, then a later platform_get_resource() will cause invalid address access. 2) If (res && num =3D=3D 0), because num =3D=3D 0 cause kmalloc_slab() retu= rns ZERO_SIZE_PTR, then kmemdup() will copy data to the invalid address ZERO_SIZE_PTR. Signed-off-by: Xujun Leng --- drivers/base/platform.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/base/platform.c b/drivers/base/platform.c index 77510e4f47de..a060941c3076 100644 --- a/drivers/base/platform.c +++ b/drivers/base/platform.c @@ -606,6 +606,9 @@ int platform_device_add_resources(struct platform_devic= e *pdev, { struct resource *r =3D NULL; =20 + if ((!res && num > 0) || (res && num =3D=3D 0)) + return -EINVAL; + if (res) { r =3D kmemdup(res, sizeof(struct resource) * num, GFP_KERNEL); if (!r) --=20 2.25.1