[PATCH v3] clk: zynq: Prevent null pointer dereference caused by kmalloc failure

[duoming at zju.edu.cn]

On Fri, 1 Mar 2024 08:30:05 +0100 Michal Simek wrote:
> >>> The kmalloc() in zynq_clk_setup() will return null if the
> >>> physical memory has run out. As a result, if we use snprintf()
> >>> to write data to the null address, the null pointer dereference
> >>> bug will happen.
> >>>
> >>> This patch uses a stack variable to replace the kmalloc().
> >>>
> >>> Fixes: 0ee52b157b8e ("clk: zynq: Add clock controller driver")
> >>> Signed-off-by: Duoming Zhou <duoming at zju.edu.cn>
> >>> ---
> >>> Changes in v3:
> >>>     - Put stack variable in the head of the function and remove variable tmp.
> >>>
> >>>    drivers/clk/zynq/clkc.c | 7 ++-----
> >>>    1 file changed, 2 insertions(+), 5 deletions(-)
> >>>
> >>> diff --git a/drivers/clk/zynq/clkc.c b/drivers/clk/zynq/clkc.c
> >>> index 7bdeaff2bfd..45479653c3b 100644
> >>> --- a/drivers/clk/zynq/clkc.c
> >>> +++ b/drivers/clk/zynq/clkc.c
> >>> @@ -215,7 +215,7 @@ static void __init zynq_clk_setup(struct device_node *np)
> >>>    	int i;
> >>>    	u32 tmp;
> >>>    	int ret;
> >>> -	char *clk_name;
> >>> +	char clk_name[16];
> >>>    	unsigned int fclk_enable = 0;
> >>>    	const char *clk_output_name[clk_max];
> >>>    	const char *cpu_parents[4];
> >>> @@ -426,12 +426,10 @@ static void __init zynq_clk_setup(struct device_node *np)
> >>>    			"gem1_emio_mux", CLK_SET_RATE_PARENT,
> >>>    			SLCR_GEM1_CLK_CTRL, 0, 0, &gem1clk_lock);
> >>>    
> >>> -	tmp = strlen("mio_clk_00x");
> >>> -	clk_name = kmalloc(tmp, GFP_KERNEL);
> >>>    	for (i = 0; i < NUM_MIO_PINS; i++) {
> >>>    		int idx;
> >>>    
> >>> -		snprintf(clk_name, tmp, "mio_clk_%2.2d", i);
> >>> +		snprintf(clk_name, 16, "mio_clk_%2.2d", i);
> >>
> >> I would prefer to use macro/define if that values has to match and have connection.
> > 
> > The origin code "clk_name = kmalloc(tmp, GFP_KERNEL)" allocates 16 bytes, so I set
> > the size of stack variable clk_name to 16 bytes.
> > 
> > Do you think if we use "#define CLK_NAME_LEN 16" is better?
> 
> name is fine for me. What macro gives you is that you know that number 16 from 
> array size is the same number 16 which you are checking.
> It is clear from your patch but some time from now someone can change just one 
> part of code without looking at connection.

Thank you for your suggestions! I will use "CLK_NAME_LEN" to replace the 16.

Best regards,
Duoming Zhou