]> www.infradead.org Git - users/jedix/linux-maple.git/commit
regulator: tps65219: Fix devm_kmalloc size allocation
authorShree Ramamoorthy <s-ramamoorthy@ti.com>
Fri, 20 Jun 2025 15:45:41 +0000 (10:45 -0500)
committerMark Brown <broonie@kernel.org>
Sun, 29 Jun 2025 21:10:41 +0000 (22:10 +0100)
commiteeca209124bb694650026216d3e59cae02d91686
tree86e9744673966b497491f0445ba3e7867ed213ae
parentca46946a482238b0cdea459fb82fc837fb36260e
regulator: tps65219: Fix devm_kmalloc size allocation

In probe(), two arrays of structs are allocated with the devm_kmalloc()
function, but the memory size of the allocations were given as the arrays'
length (pmic->common_irq_size for the first call and pmic->dev_irq_size for
the second devm_kmalloc call). The memory size should have been the total
memory needed.

This led to a heap overflow when the struct array was used. The issue was
first discovered with the PocketBeagle2 and BeaglePlay. The common and
device-specific structs are now allocated one at a time within the loop.

Fixes: 38c9f98db20a ("regulator: tps65219: Add support for TPS65215 Regulator IRQs")
Reported-by: Dhruva Gole <d-gole@ti.com>
Closes: https://lore.kernel.org/all/20250619153526.297398-1-d-gole@ti.com/
Tested-by: Robert Nelson <robertcnelson@gmail.com>
Acked-by: Andrew Davis <afd@ti.com>
Signed-off-by: Shree Ramamoorthy <s-ramamoorthy@ti.com>
Reviewed-by: Nishanth Menon <nm@ti.com>
Link: https://patch.msgid.link/20250620154541.2713036-1-s-ramamoorthy@ti.com
Signed-off-by: Mark Brown <broonie@kernel.org>
drivers/regulator/tps65219-regulator.c