Patch "spi: spi-zynq-qspi: Fix a NULL pointer dereference in zynq_qspi_exec_mem_op()" has been added to the 5.4-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    spi: spi-zynq-qspi: Fix a NULL pointer dereference in zynq_qspi_exec_mem_op()

to the 5.4-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     spi-spi-zynq-qspi-fix-a-null-pointer-dereference-in-.patch
and it can be found in the queue-5.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 784fb931a0f4f5fca880f2cfcca103797963e3b9
Author: Zhou Qingyang <zhou1615@xxxxxxx>
Date:   Wed Dec 1 01:22:53 2021 +0800

    spi: spi-zynq-qspi: Fix a NULL pointer dereference in zynq_qspi_exec_mem_op()
    
    [ Upstream commit ab3824427b848da10e9fe2727f035bbeecae6ff4 ]
    
    In zynq_qspi_exec_mem_op(), kzalloc() is directly used in memset(),
    which could lead to a NULL pointer dereference on failure of
    kzalloc().
    
    Fix this bug by adding a check of tmpbuf.
    
    This bug was found by a static analyzer. The analysis employs
    differential checking to identify inconsistent security operations
    (e.g., checks or kfrees) between two code paths and confirms that the
    inconsistent operations are not recovered in the current function or
    the callers, so they constitute bugs.
    
    Note that, as a bug found by static analysis, it can be a false
    positive or hard to trigger. Multiple researchers have cross-reviewed
    the bug.
    
    Builds with CONFIG_SPI_ZYNQ_QSPI=m show no new warnings,
    and our static analyzer no longer warns about this code.
    
    Fixes: 67dca5e580f1 ("spi: spi-mem: Add support for Zynq QSPI controller")
    Signed-off-by: Zhou Qingyang <zhou1615@xxxxxxx>
    Link: https://lore.kernel.org/r/20211130172253.203700-1-zhou1615@xxxxxxx
    Signed-off-by: Mark Brown <broonie@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/spi/spi-zynq-qspi.c b/drivers/spi/spi-zynq-qspi.c
index 1ced6eb8b3303..b3588240eb39b 100644
--- a/drivers/spi/spi-zynq-qspi.c
+++ b/drivers/spi/spi-zynq-qspi.c
@@ -558,6 +558,9 @@ static int zynq_qspi_exec_mem_op(struct spi_mem *mem,
 
 	if (op->dummy.nbytes) {
 		tmpbuf = kzalloc(op->dummy.nbytes, GFP_KERNEL);
+		if (!tmpbuf)
+			return -ENOMEM;
+
 		memset(tmpbuf, 0xff, op->dummy.nbytes);
 		reinit_completion(&xqspi->data_completion);
 		xqspi->txbuf = tmpbuf;