iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ACPI/nfit: avoid accessing uninitialized memory in acpi_nfit_ctl()

Browse Source 
The ACPI_ALLOCATE() does not zero the "buf", so when the condition
"integer->type != ACPI_TYPE_INTEGER" in int_to_buf() is met, the result
is unpredictable in acpi_nfit_ctl().

Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
Reviewed-by: Dan Williams <dan.j.williams@intel.com>
Link: https://lore.kernel.org/r/20201118073517.1884-1-thunder.leizhen@huawei.com
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
This commit is contained in:
Zhen Lei 2020-11-18 15:35:17 +08:00 committed by Dan Williams
parent 09162bc32c
commit 1a57b1a3e1
1 changed files with 5 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
drivers/acpi/nfit/core.c
View File

@ -282,18 +282,19 @@ err:
static union acpi_object *int_to_buf(union acpi_object *integer)
{
union acpi_object *buf = ACPI_ALLOCATE(sizeof(*buf) + 4);
union acpi_object *buf = NULL;
void *dst = NULL;
if (!buf)
goto err;
if (integer->type != ACPI_TYPE_INTEGER) {
WARN_ONCE(1, "BIOS bug, unexpected element type: %d\n",
integer->type);
goto err;
}
buf = ACPI_ALLOCATE(sizeof(*buf) + 4);
if (!buf)
goto err;
dst = buf + 1;
buf->type = ACPI_TYPE_BUFFER;
buf->buffer.length = 4;