Commit 1a57b1a3 authored Nov 18, 2020 by Zhen Lei Committed by Dan Williams Nov 18, 2020

ACPI/nfit: avoid accessing uninitialized memory in acpi_nfit_ctl()



The ACPI_ALLOCATE() does not zero the "buf", so when the condition
"integer->type != ACPI_TYPE_INTEGER" in int_to_buf() is met, the result
is unpredictable in acpi_nfit_ctl().

Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
Reviewed-by: Dan Williams <dan.j.williams@intel.com>
Link: https://lore.kernel.org/r/20201118073517.1884-1-thunder.leizhen@huawei.com


Signed-off-by: Dan Williams <dan.j.williams@intel.com>

parent 09162bc3

drivers/acpi/nfit/core.c

+5 −4

Original line number	Diff line number	Diff line
		@@ -282,18 +282,19 @@ err:

		static union acpi_object int_to_buf(union acpi_object integer)
		{
		union acpi_object buf = ACPI_ALLOCATE(sizeof(buf) + 4);
		union acpi_object *buf = NULL;
		void *dst = NULL;

		if (!buf)
		goto err;

		if (integer->type != ACPI_TYPE_INTEGER) {
		WARN_ONCE(1, "BIOS bug, unexpected element type: %d\n",
		integer->type);
		goto err;
		}

		buf = ACPI_ALLOCATE(sizeof(*buf) + 4);
		if (!buf)
		goto err;

		dst = buf + 1;
		buf->type = ACPI_TYPE_BUFFER;
		buf->buffer.length = 4;

Admin message