d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix use of uninitialised variable.

Browse Source 
The RK805 regs array was being allocated before it's required size was
known, causing the driver to use memory it didn't own.  That memory
was subsequently allocated and used elsewhere causing later fatal data
aborts in rk805_map().

Whilst I'm here, add a sanity check to catch unsupported PMICs (this
shouldn't ever get hit because the probe should have failed).

Reviewed by:	manu
MFC after:	1 week
Sponsored by:	Google
This commit is contained in:
peterj 2019-10-25 19:38:02 +00:00
parent d7908b9933
commit 2fc0413f87
1 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
sys/arm64/rockchip/rk805.c
View File

@ -467,9 +467,6 @@ rk805_attach(device_t dev)
if (config_intrhook_establish(&sc->intr_hook) != 0)
return (ENOMEM);
sc->regs = malloc(sizeof(struct rk805_reg_sc *) * sc->nregs,
M_RK805_REG, M_WAITOK | M_ZERO);
sc->type = ofw_bus_search_compatible(dev, compat_data)->ocd_data;
switch (sc->type) {
case RK805:
@ -480,8 +477,14 @@ rk805_attach(device_t dev)
regdefs = rk808_regdefs;
sc->nregs = nitems(rk808_regdefs);
break;
default:
device_printf(dev, "Unknown type %d\n", sc->type);
return (ENXIO);
}
sc->regs = malloc(sizeof(struct rk805_reg_sc *) * sc->nregs,
M_RK805_REG, M_WAITOK | M_ZERO);
rnode = ofw_bus_find_child(ofw_bus_get_node(dev), "regulators");
if (rnode > 0) {
for (i = 0; i < sc->nregs; i++) {