[PATCH] i2c: brcmstb: allocate correct amount of memory for regmap

We want the size of the struct, not of a pointer to it. To be future
proof, just dereference the pointer to get the desired type.

Signed-off-by: Wolfram Sang <redacted>
---
 drivers/i2c/busses/i2c-brcmstb.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/i2c/busses/i2c-brcmstb.c b/drivers/i2c/busses/i2c-brcmstb.c
index 3711df1d452622..4a45408dd82060 100644
--- a/drivers/i2c/busses/i2c-brcmstb.c
+++ b/drivers/i2c/busses/i2c-brcmstb.c

@@ -586,8 +586,7 @@ static int brcmstb_i2c_probe(struct platform_device *pdev)
 	if (!dev)
 		return -ENOMEM;
 
-	dev->bsc_regmap = devm_kzalloc(&pdev->dev, sizeof(struct bsc_regs *),
-				       GFP_KERNEL);
+	dev->bsc_regmap = devm_kzalloc(&pdev->dev, sizeof(*dev->bsc_regmap), GFP_KERNEL);
 	if (!dev->bsc_regmap)
 		return -ENOMEM;
 

-- 
2.7.0

On Sun, Feb 21, 2016 at 6:16 AM, Wolfram Sang [off-list ref] wrote:

We want the size of the struct, not of a pointer to it. To be future
proof, just dereference the pointer to get the desired type.

This looks like it fixes like a fairly serious issue: before this
change, the driver may modify memory that wasn't allocated for this
struct.  Shouldn't this also have Cc: stable?

Signed-off-by: Wolfram Sang <redacted>

Acked-by: Gregory Fong <redacted>

On Sun, Feb 21, 2016 at 10:33:14PM -0800, Gregory Fong wrote:

On Sun, Feb 21, 2016 at 6:16 AM, Wolfram Sang [off-list ref] wrote:

quoted

We want the size of the struct, not of a pointer to it. To be future
proof, just dereference the pointer to get the desired type.

This looks like it fixes like a fairly serious issue: before this
change, the driver may modify memory that wasn't allocated for this
struct.  Shouldn't this also have Cc: stable?

Surely. I usually add the tag when committing, not when sending out.

quoted

Signed-off-by: Wolfram Sang <redacted>

Acked-by: Gregory Fong <redacted>

Thanks.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: not available
URL: <http://lists.infradead.org/pipermail/linux-arm-kernel/attachments/20160222/544259df/attachment.sig>

Le 21/02/2016 06:16, Wolfram Sang a ?crit :

We want the size of the struct, not of a pointer to it. To be future
proof, just dereference the pointer to get the desired type.

Signed-off-by: Wolfram Sang <redacted>

Fixes: dd1aa2524bc5 ("i2c: brcmstb: Add Broadcom settop SoC i2c
controller driver")

Acked-by: Florian Fainelli <f.fainelli@gmail.com>

Thanks!
-- 
Florian

We want the size of the struct, not of a pointer to it. To be future 
proof, just dereference the pointer to get the desired type.

Thanks for catching and fixing this.

Signed-off-by: Wolfram Sang <redacted>

Reviewed-by: Kamal Dasu <redacted>

Kamal

On Sun, Feb 21, 2016 at 03:16:48PM +0100, Wolfram Sang wrote:

We want the size of the struct, not of a pointer to it. To be future
proof, just dereference the pointer to get the desired type.

Signed-off-by: Wolfram Sang <redacted>

Applied to for-current with stable tag added, thanks!

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: not available
URL: <http://lists.infradead.org/pipermail/linux-arm-kernel/attachments/20160301/27b2c0c2/attachment-0001.sig>