Skip to content

Commit

Permalink
ACPI/nfit: avoid accessing uninitialized memory in acpi_nfit_ctl()
Browse files Browse the repository at this point in the history
The ACPI_ALLOCATE() does not zero the "buf", so when the condition
"integer->type != ACPI_TYPE_INTEGER" in int_to_buf() is met, the result
is unpredictable in acpi_nfit_ctl().

Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
Reviewed-by: Dan Williams <dan.j.williams@intel.com>
Link: https://lore.kernel.org/r/20201118073517.1884-1-thunder.leizhen@huawei.com
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
  • Loading branch information
Zhen Lei authored and Dan Williams committed Nov 18, 2020
1 parent 09162bc commit 1a57b1a
Showing 1 changed file with 5 additions and 4 deletions.
9 changes: 5 additions & 4 deletions drivers/acpi/nfit/core.c
Original file line number Diff line number Diff line change
Expand Up @@ -282,18 +282,19 @@ static union acpi_object *pkg_to_buf(union acpi_object *pkg)

static union acpi_object *int_to_buf(union acpi_object *integer)
{
union acpi_object *buf = ACPI_ALLOCATE(sizeof(*buf) + 4);
union acpi_object *buf = NULL;
void *dst = NULL;

if (!buf)
goto err;

if (integer->type != ACPI_TYPE_INTEGER) {
WARN_ONCE(1, "BIOS bug, unexpected element type: %d\n",
integer->type);
goto err;
}

buf = ACPI_ALLOCATE(sizeof(*buf) + 4);
if (!buf)
goto err;

dst = buf + 1;
buf->type = ACPI_TYPE_BUFFER;
buf->buffer.length = 4;
Expand Down

0 comments on commit 1a57b1a

Please sign in to comment.