Date: Fri, 25 Oct 2019 19:38:02 +0000 (UTC) From: Peter Jeremy <peterj@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r354094 - head/sys/arm64/rockchip Message-ID: <201910251938.x9PJc2cu074991@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: peterj Date: Fri Oct 25 19:38:02 2019 New Revision: 354094 URL: https://svnweb.freebsd.org/changeset/base/354094 Log: Fix use of uninitialised variable. The RK805 regs array was being allocated before it's required size was known, causing the driver to use memory it didn't own. That memory was subsequently allocated and used elsewhere causing later fatal data aborts in rk805_map(). Whilst I'm here, add a sanity check to catch unsupported PMICs (this shouldn't ever get hit because the probe should have failed). Reviewed by: manu MFC after: 1 week Sponsored by: Google Modified: head/sys/arm64/rockchip/rk805.c Modified: head/sys/arm64/rockchip/rk805.c ============================================================================== --- head/sys/arm64/rockchip/rk805.c Fri Oct 25 18:56:46 2019 (r354093) +++ head/sys/arm64/rockchip/rk805.c Fri Oct 25 19:38:02 2019 (r354094) @@ -467,9 +467,6 @@ rk805_attach(device_t dev) if (config_intrhook_establish(&sc->intr_hook) != 0) return (ENOMEM); - sc->regs = malloc(sizeof(struct rk805_reg_sc *) * sc->nregs, - M_RK805_REG, M_WAITOK | M_ZERO); - sc->type = ofw_bus_search_compatible(dev, compat_data)->ocd_data; switch (sc->type) { case RK805: @@ -480,7 +477,13 @@ rk805_attach(device_t dev) regdefs = rk808_regdefs; sc->nregs = nitems(rk808_regdefs); break; + default: + device_printf(dev, "Unknown type %d\n", sc->type); + return (ENXIO); } + + sc->regs = malloc(sizeof(struct rk805_reg_sc *) * sc->nregs, + M_RK805_REG, M_WAITOK | M_ZERO); rnode = ofw_bus_find_child(ofw_bus_get_node(dev), "regulators"); if (rnode > 0) {
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201910251938.x9PJc2cu074991>