> virtio_gpio_get_names() computes the size of the GET_LINE_NAMES response
> as sizeof(*res) + gpio_names_size in an int, where gpio_names_size is a
> u32 from the config space. A gpio_names_size of 0xffffffff makes the
> size 0, devm_kzalloc() returns ZERO_SIZE_PTR, and reading the status
> byte of the response through it oopses:
>
> Oops: general protection fault, probably for non-canonical address
> 0xdffffc0000000002: 0000 [#1] SMP KASAN PTI
> KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
> RIP: 0010:_virtio_gpio_req+0x2b8/0x550
> Call Trace:
> virtio_gpio_probe+0xc2a/0xfc0
> virtio_dev_probe+0xa7a/0xc50
>
> Compute the size with struct_size() into a size_t.
>
> This patch is assisted by Claude Opus 5.5.
>
> Fixes: 3a29355a22c0 ("gpio: Add virtio-gpio driver")
> Cc: [email protected]
> Signed-off-by: Lianjie Wang <[email protected]>
Sashiko has reviewed this patch and found no issues.
--
Sashiko AI review ยท
https://sashiko.dev/#/patchset/[email protected]?part=2
