Patch "spi: spi-zynq-qspi: Fix a NULL pointer dereference in zynq_qspi_exec_mem_op()" has been added to the 5.10-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    spi: spi-zynq-qspi: Fix a NULL pointer dereference in zynq_qspi_exec_mem_op()

to the 5.10-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     spi-spi-zynq-qspi-fix-a-null-pointer-dereference-in-.patch
and it can be found in the queue-5.10 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 9124f2fcff30df4086e6dab80a7ac30731c4ed73
Author: Zhou Qingyang <zhou1615@xxxxxxx>
Date:   Wed Dec 1 01:22:53 2021 +0800

    spi: spi-zynq-qspi: Fix a NULL pointer dereference in zynq_qspi_exec_mem_op()
    
    [ Upstream commit ab3824427b848da10e9fe2727f035bbeecae6ff4 ]
    
    In zynq_qspi_exec_mem_op(), kzalloc() is directly used in memset(),
    which could lead to a NULL pointer dereference on failure of
    kzalloc().
    
    Fix this bug by adding a check of tmpbuf.
    
    This bug was found by a static analyzer. The analysis employs
    differential checking to identify inconsistent security operations
    (e.g., checks or kfrees) between two code paths and confirms that the
    inconsistent operations are not recovered in the current function or
    the callers, so they constitute bugs.
    
    Note that, as a bug found by static analysis, it can be a false
    positive or hard to trigger. Multiple researchers have cross-reviewed
    the bug.
    
    Builds with CONFIG_SPI_ZYNQ_QSPI=m show no new warnings,
    and our static analyzer no longer warns about this code.
    
    Fixes: 67dca5e580f1 ("spi: spi-mem: Add support for Zynq QSPI controller")
    Signed-off-by: Zhou Qingyang <zhou1615@xxxxxxx>
    Link: https://lore.kernel.org/r/20211130172253.203700-1-zhou1615@xxxxxxx
    Signed-off-by: Mark Brown <broonie@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/spi/spi-zynq-qspi.c b/drivers/spi/spi-zynq-qspi.c
index b635835729d66..13c0b15fe1764 100644
--- a/drivers/spi/spi-zynq-qspi.c
+++ b/drivers/spi/spi-zynq-qspi.c
@@ -570,6 +570,9 @@ static int zynq_qspi_exec_mem_op(struct spi_mem *mem,
 
 	if (op->dummy.nbytes) {
 		tmpbuf = kzalloc(op->dummy.nbytes, GFP_KERNEL);
+		if (!tmpbuf)
+			return -ENOMEM;
+
 		memset(tmpbuf, 0xff, op->dummy.nbytes);
 		reinit_completion(&xqspi->data_completion);
 		xqspi->txbuf = tmpbuf;