drivers: richtek: fix write-out-of-bounds in rt1711_init_alert()
KASAN warns about a write-out-of-bounds in rt1711_init_alert():
len = strlen(chip->tcpc_desc->name);
name = kzalloc(sizeof(len + 5), GFP_KERNEL); <- allocated here
sprintf(name, "%s-IRQ", chip->tcpc_desc->name); <- written here
The stray sizeof() operator means it's allocating 4 bytes rather than
the intended strlen(...) + 5 bytes.
Change-Id: Iaecc36682754948c9fa983ab9a88486690a1358d
Signed-off-by:
Greg Hackmann <ghackmann@google.com>
Loading
Please register or sign in to comment