char: aml-gpiomem: Use allocated pointer for class registration

The class name for class_create() requires memory pointer not freed
until the class is destroy, but local array is used, so it causes
memory bad access. Use allocated pointer for class registration.

This fixes below kasan warning:
   BUG: KASAN: out-of-bounds in strlcpy+0x48/0x88
   Read of size 11 at addr ffffffc00029f9c0 by task udevadm/2912
   ...
   [<ffffff900941ca9c>] check_memory_region+0x12c/0x1a0
   [<ffffff900941d0d4>] memcpy+0x34/0x68
   [<ffffff9009af8968>] strlcpy+0x48/0x88
   [<ffffff9009aeb74c>] kobject_uevent_env+0x55c/0x948
   [<ffffff9009aebb48>] kobject_uevent+0x10/0x18
   [<ffffff9009de5ca0>] uevent_store+0xf0/0xf8
   ...

Change-Id: I0e265a8b1b52e732de262a0058bd821419ca4fe8
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>

diff --git a/drivers/char/aml-gpiomem.c b/drivers/char/aml-gpiomem.c
index 5c71560..1d2d2dc 100644 (file)
--- a/drivers/char/aml-gpiomem.c
+++ b/drivers/char/aml-gpiomem.c
@@ -62,6 +62,7 @@ struct aml_gpiomem_instance {
        unsigned long gpio_regs_phys;
        struct device *dev;
        char dev_name[32];
+       char class_name[64];
        int major;
 };
 
@@ -166,7 +167,6 @@ static int aml_gpiomem_probe(struct platform_device *pdev)
        struct device *dev = &pdev->dev;
        struct resource *ioresource;
        const char *str;
-       char tmp[64];
        struct aml_gpiomem_instance *inst = NULL;
 
        /* Allocate buffers and instance data */
@@ -200,9 +200,9 @@ static int aml_gpiomem_probe(struct platform_device *pdev)
        inst->dev_name[31] = '\0';
 
        /* Create character device entries */
-       sprintf(tmp, "aml-%s", inst->dev_name);
+       sprintf(inst->class_name, "aml-%s", inst->dev_name);
        err = alloc_chrdev_region(&aml_gpiomem_devid,
-                                 DEVICE_MINOR, 1, tmp);
+                                 DEVICE_MINOR, 1, inst->class_name);
        if (err != 0) {
                dev_err(inst->dev, "unable to allocate device number");
                goto failed_alloc_chrdev;
@@ -216,7 +216,7 @@ static int aml_gpiomem_probe(struct platform_device *pdev)
        }
 
        /* Create sysfs entries */
-       aml_gpiomem_class = class_create(THIS_MODULE, tmp);
+       aml_gpiomem_class = class_create(THIS_MODULE, inst->class_name);
        ptr_err = aml_gpiomem_class;
        if (IS_ERR(ptr_err))
                goto failed_class_create;