diff options
| author | Zhen Lei <thunder.leizhen@huawei.com> | 2020-11-18 08:35:17 +0100 |
|---|---|---|
| committer | Dan Williams <dan.j.williams@intel.com> | 2020-11-18 20:46:18 +0100 |
| commit | 1a57b1a3e11086a4f183b245754b213b1d9b2d40 (patch) | |
| tree | 94fbce75353fbba7b7c53fe3eea7333e03f53211 | |
| parent | Linux 5.10-rc4 (diff) | |
| download | linux-1a57b1a3e11086a4f183b245754b213b1d9b2d40.tar.xz linux-1a57b1a3e11086a4f183b245754b213b1d9b2d40.zip | |
ACPI/nfit: avoid accessing uninitialized memory in acpi_nfit_ctl()
The ACPI_ALLOCATE() does not zero the "buf", so when the condition
"integer->type != ACPI_TYPE_INTEGER" in int_to_buf() is met, the result
is unpredictable in acpi_nfit_ctl().
Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
Reviewed-by: Dan Williams <dan.j.williams@intel.com>
Link: https://lore.kernel.org/r/20201118073517.1884-1-thunder.leizhen@huawei.com
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
| -rw-r--r-- | drivers/acpi/nfit/core.c | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c index 442608220b5c..cda7b6c52504 100644 --- a/drivers/acpi/nfit/core.c +++ b/drivers/acpi/nfit/core.c @@ -282,18 +282,19 @@ err: static union acpi_object *int_to_buf(union acpi_object *integer) { - union acpi_object *buf = ACPI_ALLOCATE(sizeof(*buf) + 4); + union acpi_object *buf = NULL; void *dst = NULL; - if (!buf) - goto err; - if (integer->type != ACPI_TYPE_INTEGER) { WARN_ONCE(1, "BIOS bug, unexpected element type: %d\n", integer->type); goto err; } + buf = ACPI_ALLOCATE(sizeof(*buf) + 4); + if (!buf) + goto err; + dst = buf + 1; buf->type = ACPI_TYPE_BUFFER; buf->buffer.length = 4; |