[3.13.y.z extended stable] Patch "regmap: fix possible ZERO_SIZE_PTR pointer dereferencing error." has been added to staging queue

[Kamal Mostafa]

This is a note to let you know that I have just added a patch titled

    regmap: fix possible ZERO_SIZE_PTR pointer dereferencing error.

to the linux-3.13.y-queue branch of the 3.13.y.z extended stable tree 
which can be found at:

 http://kernel.ubuntu.com/git?p=ubuntu/linux.git;a=shortlog;h=refs/heads/linux-3.13.y-queue

This patch is scheduled to be released in version 3.13.11.10.

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.13.y.z tree, see
https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable

Thanks.
-Kamal

------

>From 6ae8fcd9d3e8fc346ff491ae08b76f6b148f8eb0 Mon Sep 17 00:00:00 2001
From: Xiubo Li <Li.Xiubo at freescale.com>
Date: Sun, 28 Sep 2014 17:09:54 +0800
Subject: regmap: fix possible ZERO_SIZE_PTR pointer dereferencing error.

commit d6b41cb06044a7d895db82bdd54f6e4219970510 upstream.

Since we cannot make sure the 'val_count' will always be none zero
here, and then if it equals to zero, the kmemdup() will return
ZERO_SIZE_PTR, which equals to ((void *)16).

So this patch fix this with just doing the zero check before calling
kmemdup().

Signed-off-by: Xiubo Li <Li.Xiubo at freescale.com>
Signed-off-by: Mark Brown <broonie at kernel.org>
Signed-off-by: Kamal Mostafa <kamal at canonical.com>
---
 drivers/base/regmap/regmap.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
index 1ac3c9a..ebe332c 100644
--- a/drivers/base/regmap/regmap.c
+++ b/drivers/base/regmap/regmap.c
@@ -1529,6 +1529,9 @@ int regmap_bulk_write(struct regmap *map, unsigned int reg, const void *val,
 	if (val_bytes == 1) {
 		wval = (void *)val;
 	} else {
+		if (!val_count)
+			return -EINVAL;
+
 		wval = kmemdup(val, val_count * val_bytes, GFP_KERNEL);
 		if (!wval) {
 			ret = -ENOMEM;
--
1.9.1