Re: [PATCH v3 03/23] mfd: kempld: Simplify device abstraction

Hello,

On Thu, Jul 09, 2026 at 05:07:03PM +0000, [email protected] wrote:
> > -		ret = platform_device_add_data(pdev, pdata, sizeof(*pdata));
> > +		ret = platform_device_add_data(pdev, pdata, sizeof(pdata));
> 
> [Severity: High]
> Does this code pass the size of the pointer instead of the size of the
> struct?
> 
> Looking at kempld_probe(), pdata is a pointer to the static
> kempld_platform_data_generic structure. After the changes in this patch, the
> struct only contains a single int.
> 
> Since sizeof(pdata) evaluates to the pointer size (typically 8 bytes), could
> this cause kmemdup() inside platform_device_add_data() to read past the end
> of the structure and trigger a KASAN global-out-of-bounds read during ACPI
> platform device probe?

This is a real issue. Will address in v4. But I wait a bit before
sending that.

Best regards
Uwe

-----BEGIN PGP SIGNATURE-----

iQEzBAABCgAdFiEEP4GsaTp6HlmJrf7Tj4D7WH0S/k4FAmpQBXgACgkQj4D7WH0S
/k4RPwgAmYVSgTTgDqfIit7NF7lQ6cM1mSeCrDBWa9q+UuB4LP3DQ5/zoTuBZjk5
S06QoOT4Agdw49etj5uFfmfYWq4zKB7NNygAkQqTwyxFUYPIzWjtOd0apVK3ijLL
2Z+p/aPPM1o0vhZFp6t106aHJlhhzrkFI88X0GDEWBnQgL2TVgzdxKiRzeXlqNxU
+iJVJBZb2IFMvwtj59wxIB7+q0RZwDJN7yTR/sGGn8Rv5bEZYbwUT2ecBouJJKNU
E1R0RJfw3N2SjPW5Rs7sYfgrgio/3Y41yimbNgHyz1rWVuyhmWHo8d9i6Wdma3Dk
ljXknnLpm1glQOjEnqc3n8F3bIsXIg==
=FjBW
-----END PGP SIGNATURE-----