drivers/i2c/busses/i2c-cp2615.c | 6 ++++++ 1 file changed, 6 insertions(+)
Check the result of kzalloc_obj() before dereferencing the allocated
message structure.
Signed-off-by: Triet Hoang <triet.hoang.dev@gmail.com>
---
drivers/i2c/busses/i2c-cp2615.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/i2c/busses/i2c-cp2615.c b/drivers/i2c/busses/i2c-cp2615.c
index 951de6249..178a35d0b 100644
--- a/drivers/i2c/busses/i2c-cp2615.c
+++ b/drivers/i2c/busses/i2c-cp2615.c
@@ -125,6 +125,9 @@ static int
cp2615_i2c_send(struct usb_interface *usbif, struct cp2615_i2c_transfer *i2c_w)
{
struct cp2615_iop_msg *msg = kzalloc_obj(*msg);
+ if (!msg)
+ return -ENOMEM;
+
struct usb_device *usbdev = interface_to_usbdev(usbif);
int res = cp2615_init_i2c_msg(msg, i2c_w);
@@ -172,6 +175,9 @@ cp2615_i2c_recv(struct usb_interface *usbif, unsigned char tag, void *buf)
static int cp2615_check_iop(struct usb_interface *usbif)
{
struct cp2615_iop_msg *msg = kzalloc_obj(*msg);
+ if (!msg)
+ return -ENOMEM;
+
struct cp2615_iop_accessory_info *info = (struct cp2615_iop_accessory_info *)&msg->data;
struct usb_device *usbdev = interface_to_usbdev(usbif);
int res = cp2615_init_iop_msg(msg, iop_GetAccessoryInfo, NULL, 0);
--
2.53.0
Check the result of kzalloc_obj() and return -ENOMEM
when the allocation fails instead of passing a NULL pointer
to the message initialization helpers, which would return -EINVAL.
Signed-off-by: Triet Hoang <triet.hoang.dev@gmail.com>
---
Changes in v2:
- Clarify the commit message to describe the actual behavior change.
- Fix coding style regression
---
drivers/i2c/busses/i2c-cp2615.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/i2c/busses/i2c-cp2615.c b/drivers/i2c/busses/i2c-cp2615.c
index 951de6249834..c1275fcad636 100644
--- a/drivers/i2c/busses/i2c-cp2615.c
+++ b/drivers/i2c/busses/i2c-cp2615.c
@@ -128,6 +128,9 @@ cp2615_i2c_send(struct usb_interface *usbif, struct cp2615_i2c_transfer *i2c_w)
struct usb_device *usbdev = interface_to_usbdev(usbif);
int res = cp2615_init_i2c_msg(msg, i2c_w);
+ if (!msg)
+ return -ENOMEM;
+
if (!res)
res = usb_bulk_msg(usbdev, usb_sndbulkpipe(usbdev, IOP_EP_OUT),
msg, ntohs(msg->length), NULL, 0);
@@ -176,6 +179,9 @@ static int cp2615_check_iop(struct usb_interface *usbif)
struct usb_device *usbdev = interface_to_usbdev(usbif);
int res = cp2615_init_iop_msg(msg, iop_GetAccessoryInfo, NULL, 0);
+ if (!msg)
+ return -ENOMEM;
+
if (res)
goto out;
--
2.53.0
> Check the result of kzalloc_obj() and return -ENOMEM > when the allocation fails instead of passing a NULL pointer > to the message initialization helpers, which would return -EINVAL. * How do you think about to add any tags (like “Fixes” and “Cc”) accordingly? https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/submitting-patches.rst?h=v7.2#n145 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/stable-kernel-rules.rst?h=v7.2#n34 * How do you think about to increase the application of scope-based resource management? Regards, Markus
© 2016 - 2026 Red Hat, Inc.