[PATCH master] usb: typec: fix freeing uninitialized memory

[PATCH master] usb: typec: fix freeing uninitialized memory

[Ahmad Fatoum]

When the code was first added, a kzalloc was allocating the memory for
the struct device. This has been recently changed to malloc as a
shifting of the header caused the function to be no longer defined.

malloc() doesn't zero the memory though, leading to a potential freeing
of uninitialized memory in dev_set_name.

Fix this by using calloc() instead. Reintroducing kzalloc() would be
fine too, but calloc() saves some space, because it guarantees a smaller
alignment.

Fixes: d9fa8b26b60c ("usb: typec: fix compile test with CONFIG_SANDBOX")
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 drivers/usb/typec/class.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/typec/class.c b/drivers/usb/typec/class.c
index 495ac794622f..9f9b4d6ca8f3 100644
--- a/drivers/usb/typec/class.c
+++ b/drivers/usb/typec/class.c
@@ -142,7 +142,7 @@ struct typec_port *typec_register_port(struct device *parent,
 	const char *alias;
 	int ret;
 
-	port = malloc(sizeof(*port));
+	port = calloc(sizeof(*port), 1);
 	if (!port)
 		return ERR_PTR(-ENOMEM);
 
-- 
2.39.5

Re: [PATCH master] usb: typec: fix freeing uninitialized memory

[Marco Felsch]

Hi Ahmad,

On 24-11-22, Ahmad Fatoum wrote:
> When the code was first added, a kzalloc was allocating the memory for
> the struct device. This has been recently changed to malloc as a
> shifting of the header caused the function to be no longer defined.
> 
> malloc() doesn't zero the memory though, leading to a potential freeing
> of uninitialized memory in dev_set_name.
> 
> Fix this by using calloc() instead. Reintroducing kzalloc() would be
> fine too, but calloc() saves some space, because it guarantees a smaller
> alignment.
> 
> Fixes: d9fa8b26b60c ("usb: typec: fix compile test with CONFIG_SANDBOX")
> Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
> ---
>  drivers/usb/typec/class.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/usb/typec/class.c b/drivers/usb/typec/class.c
> index 495ac794622f..9f9b4d6ca8f3 100644
> --- a/drivers/usb/typec/class.c
> +++ b/drivers/usb/typec/class.c
> @@ -142,7 +142,7 @@ struct typec_port *typec_register_port(struct device *parent,
>  	const char *alias;
>  	int ret;
>  
> -	port = malloc(sizeof(*port));
> +	port = calloc(sizeof(*port), 1);

Albeit it is a nit and result is the same, the nmemb is the first
argument of calloc().

Regards,
  Marco

>  	if (!port)
>  		return ERR_PTR(-ENOMEM);
>  
> -- 
> 2.39.5
> 
> 
> 

Re: [PATCH master] usb: typec: fix freeing uninitialized memory

[Ahmad Fatoum]

Hi Marco,

On 22.11.24 11:28, Marco Felsch wrote:
> Hi Ahmad,
> 
> On 24-11-22, Ahmad Fatoum wrote:
>> When the code was first added, a kzalloc was allocating the memory for
>> the struct device. This has been recently changed to malloc as a
>> shifting of the header caused the function to be no longer defined.
>>
>> malloc() doesn't zero the memory though, leading to a potential freeing
>> of uninitialized memory in dev_set_name.
>>
>> Fix this by using calloc() instead. Reintroducing kzalloc() would be
>> fine too, but calloc() saves some space, because it guarantees a smaller
>> alignment.
>>
>> Fixes: d9fa8b26b60c ("usb: typec: fix compile test with CONFIG_SANDBOX")
>> Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
>> ---
>>  drivers/usb/typec/class.c | 2 +-
>>  1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/drivers/usb/typec/class.c b/drivers/usb/typec/class.c
>> index 495ac794622f..9f9b4d6ca8f3 100644
>> --- a/drivers/usb/typec/class.c
>> +++ b/drivers/usb/typec/class.c
>> @@ -142,7 +142,7 @@ struct typec_port *typec_register_port(struct device *parent,
>>  	const char *alias;
>>  	int ret;
>>  
>> -	port = malloc(sizeof(*port));
>> +	port = calloc(sizeof(*port), 1);
> 
> Albeit it is a nit and result is the same, the nmemb is the first
> argument of calloc().

Thanks, I can never remember the order, so it's a good thing it
doesn't matter anyway. :-)

Cheers,
Ahmad

> 
> Regards,
>   Marco
> 
>>  	if (!port)
>>  		return ERR_PTR(-ENOMEM);
>>  
>> -- 
>> 2.39.5
>>
>>
>>
> 


-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |

Re: [PATCH master] usb: typec: fix freeing uninitialized memory

[Sascha Hauer]

On Fri, 22 Nov 2024 10:53:26 +0100, Ahmad Fatoum wrote:
> When the code was first added, a kzalloc was allocating the memory for
> the struct device. This has been recently changed to malloc as a
> shifting of the header caused the function to be no longer defined.
> 
> malloc() doesn't zero the memory though, leading to a potential freeing
> of uninitialized memory in dev_set_name.
> 
> [...]

Applied, thanks!

[1/1] usb: typec: fix freeing uninitialized memory
      https://git.pengutronix.de/cgit/barebox/commit/?id=ae7b9c0383eb (link may not be stable)

Best regards,
-- 
Sascha Hauer <s.hauer@pengutronix.de>