regulator: tps65219: Fix devm_kmalloc size allocation
In probe(), two arrays of structs are allocated with the devm_kmalloc() function, but the memory size of the allocations were given as the arrays' length (pmic->common_irq_size for the first call and pmic->dev_irq_size for the second devm_kmalloc call). The memory size should have been the total memory needed. This led to a heap overflow when the struct array was used. The issue was first discovered with the PocketBeagle2 and BeaglePlay. The common and device-specific structs are now allocated one at a time within the loop. Fixes: 38c9f98d ("regulator: tps65219: Add support for TPS65215 Regulator IRQs") Reported-by:Dhruva Gole <d-gole@ti.com> Closes: https://lore.kernel.org/all/20250619153526.297398-1-d-gole@ti.com/ Tested-by:
Robert Nelson <robertcnelson@gmail.com> Acked-by:
Andrew Davis <afd@ti.com> Signed-off-by:
Shree Ramamoorthy <s-ramamoorthy@ti.com> Reviewed-by:
Nishanth Menon <nm@ti.com> Link: https://patch.msgid.link/20250620154541.2713036-1-s-ramamoorthy@ti.com Signed-off-by:
Mark Brown <broonie@kernel.org>
Loading
Please register or sign in to comment