virtio_gpio_get_names() computes the size of the GET_LINE_NAMES response
as sizeof(*res) + gpio_names_size in an int, where gpio_names_size is a
u32 from the config space. A gpio_names_size of 0xffffffff makes the
size 0, devm_kzalloc() returns ZERO_SIZE_PTR, and reading the status
byte of the response through it oopses:
Oops: general protection fault, probably for non-canonical address
0xdffffc0000000002: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
RIP: 0010:_virtio_gpio_req+0x2b8/0x550
Call Trace:
virtio_gpio_probe+0xc2a/0xfc0
virtio_dev_probe+0xa7a/0xc50
Compute the size with struct_size() into a size_t.
This patch is assisted by Claude Opus 5.5.
Fixes: 3a29355a22c0 ("gpio: Add virtio-gpio driver")
Cc: [email protected]
Signed-off-by: Lianjie Wang <[email protected]>
---
drivers/gpio/gpio-virtio.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/gpio/gpio-virtio.c b/drivers/gpio/gpio-virtio.c
index 32326d91f33d6..fb7b40eff37dd 100644
--- a/drivers/gpio/gpio-virtio.c
+++ b/drivers/gpio/gpio-virtio.c
@@ -494,12 +494,13 @@ static const char **virtio_gpio_get_names(struct
virtio_gpio *vgpio,
struct device *dev = &vgpio->vdev->dev;
u8 *gpio_names, *str;
const char **names;
- int i, ret, len;
+ size_t len;
+ int i, ret;
if (!gpio_names_size)
return NULL;
- len = sizeof(*res) + gpio_names_size;
+ len = struct_size(res, value, gpio_names_size);
res = devm_kzalloc(dev, len, GFP_KERNEL);
if (!res)
return NULL;
--
2.56.0
