summaryrefslogtreecommitdiff
path: root/drivers/acpi/nfit
diff options
context:
space:
mode:
authorZhen Lei <thunder.leizhen@huawei.com>2020-11-18 10:35:17 +0300
committerDan Williams <dan.j.williams@intel.com>2020-11-18 22:46:18 +0300
commit1a57b1a3e11086a4f183b245754b213b1d9b2d40 (patch)
tree94fbce75353fbba7b7c53fe3eea7333e03f53211 /drivers/acpi/nfit
parent09162bc32c880a791c6c0668ce0745cf7958f576 (diff)
downloadlinux-1a57b1a3e11086a4f183b245754b213b1d9b2d40.tar.xz
ACPI/nfit: avoid accessing uninitialized memory in acpi_nfit_ctl()
The ACPI_ALLOCATE() does not zero the "buf", so when the condition "integer->type != ACPI_TYPE_INTEGER" in int_to_buf() is met, the result is unpredictable in acpi_nfit_ctl(). Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com> Reviewed-by: Dan Williams <dan.j.williams@intel.com> Link: https://lore.kernel.org/r/20201118073517.1884-1-thunder.leizhen@huawei.com Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Diffstat (limited to 'drivers/acpi/nfit')
-rw-r--r--drivers/acpi/nfit/core.c9
1 files changed, 5 insertions, 4 deletions
diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
index 442608220b5c..cda7b6c52504 100644
--- a/drivers/acpi/nfit/core.c
+++ b/drivers/acpi/nfit/core.c
@@ -282,18 +282,19 @@ err:
static union acpi_object *int_to_buf(union acpi_object *integer)
{
- union acpi_object *buf = ACPI_ALLOCATE(sizeof(*buf) + 4);
+ union acpi_object *buf = NULL;
void *dst = NULL;
- if (!buf)
- goto err;
-
if (integer->type != ACPI_TYPE_INTEGER) {
WARN_ONCE(1, "BIOS bug, unexpected element type: %d\n",
integer->type);
goto err;
}
+ buf = ACPI_ALLOCATE(sizeof(*buf) + 4);
+ if (!buf)
+ goto err;
+
dst = buf + 1;
buf->type = ACPI_TYPE_BUFFER;
buf->buffer.length = 4;