From owner-svn-src-all@freebsd.org Fri Oct 25 19:38:03 2019 Return-Path: Delivered-To: svn-src-all@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 093801598B8; Fri, 25 Oct 2019 19:38:03 +0000 (UTC) (envelope-from peterj@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) server-signature RSA-PSS (4096 bits) client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 470Dt26D25z3yt7; Fri, 25 Oct 2019 19:38:02 +0000 (UTC) (envelope-from peterj@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id B44362B30F; Fri, 25 Oct 2019 19:38:02 +0000 (UTC) (envelope-from peterj@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id x9PJc2Mr074992; Fri, 25 Oct 2019 19:38:02 GMT (envelope-from peterj@FreeBSD.org) Received: (from peterj@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id x9PJc2cu074991; Fri, 25 Oct 2019 19:38:02 GMT (envelope-from peterj@FreeBSD.org) Message-Id: <201910251938.x9PJc2cu074991@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: peterj set sender to peterj@FreeBSD.org using -f From: Peter Jeremy Date: Fri, 25 Oct 2019 19:38:02 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r354094 - head/sys/arm64/rockchip X-SVN-Group: head X-SVN-Commit-Author: peterj X-SVN-Commit-Paths: head/sys/arm64/rockchip X-SVN-Commit-Revision: 354094 X-SVN-Commit-Repository: base MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 25 Oct 2019 19:38:03 -0000 Author: peterj Date: Fri Oct 25 19:38:02 2019 New Revision: 354094 URL: https://svnweb.freebsd.org/changeset/base/354094 Log: Fix use of uninitialised variable. The RK805 regs array was being allocated before it's required size was known, causing the driver to use memory it didn't own. That memory was subsequently allocated and used elsewhere causing later fatal data aborts in rk805_map(). Whilst I'm here, add a sanity check to catch unsupported PMICs (this shouldn't ever get hit because the probe should have failed). Reviewed by: manu MFC after: 1 week Sponsored by: Google Modified: head/sys/arm64/rockchip/rk805.c Modified: head/sys/arm64/rockchip/rk805.c ============================================================================== --- head/sys/arm64/rockchip/rk805.c Fri Oct 25 18:56:46 2019 (r354093) +++ head/sys/arm64/rockchip/rk805.c Fri Oct 25 19:38:02 2019 (r354094) @@ -467,9 +467,6 @@ rk805_attach(device_t dev) if (config_intrhook_establish(&sc->intr_hook) != 0) return (ENOMEM); - sc->regs = malloc(sizeof(struct rk805_reg_sc *) * sc->nregs, - M_RK805_REG, M_WAITOK | M_ZERO); - sc->type = ofw_bus_search_compatible(dev, compat_data)->ocd_data; switch (sc->type) { case RK805: @@ -480,7 +477,13 @@ rk805_attach(device_t dev) regdefs = rk808_regdefs; sc->nregs = nitems(rk808_regdefs); break; + default: + device_printf(dev, "Unknown type %d\n", sc->type); + return (ENXIO); } + + sc->regs = malloc(sizeof(struct rk805_reg_sc *) * sc->nregs, + M_RK805_REG, M_WAITOK | M_ZERO); rnode = ofw_bus_find_child(ofw_bus_get_node(dev), "regulators"); if (rnode > 0) {