summaryrefslogtreecommitdiff
path: root/fs/efivarfs
diff options
context:
space:
mode:
authorMatt Fleming <matt@codeblueprint.co.uk>2016-05-07 00:39:29 +0300
committerIngo Molnar <mingo@kernel.org>2016-05-07 08:06:13 +0300
commitfb7a84cac03541f4da18dfa25b3f4767d4efc6fc (patch)
treeb239ff6d7ddc4c683471909309796616f38d2133 /fs/efivarfs
parent2e121d711a51f91e792595a05cf9ef6963cb8464 (diff)
downloadlinux-fb7a84cac03541f4da18dfa25b3f4767d4efc6fc.tar.xz
efi/capsule: Move 'capsule' to the stack in efi_capsule_supported()
Dan Carpenter reports that passing the address of the pointer to the kmalloc()'d memory for 'capsule' is dangerous: "drivers/firmware/efi/capsule.c:109 efi_capsule_supported() warn: did you mean to pass the address of 'capsule' 108 109 status = efi.query_capsule_caps(&capsule, 1, &max_size, reset); ^^^^^^^^ If we modify capsule inside this function call then at the end of the function we aren't freeing the original pointer that we allocated." Ard Biesheuvel noted that we don't even need to call kmalloc() since the object we allocate isn't very big and doesn't need to persist after the function returns. Place 'capsule' on the stack instead. Suggested-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Matt Fleming <matt@codeblueprint.co.uk> Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Cc: Andy Lutomirski <luto@amacapital.net> Cc: Borislav Petkov <bp@alien8.de> Cc: Brian Gerst <brgerst@gmail.com> Cc: Bryan O'Donoghue <pure.logic@nexus-software.ie> Cc: Denys Vlasenko <dvlasenk@redhat.com> Cc: H. Peter Anvin <hpa@zytor.com> Cc: Kweh Hock Leong <hock.leong.kweh@intel.com> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: joeyli <jlee@suse.com> Cc: linux-efi@vger.kernel.org Link: http://lkml.kernel.org/r/1462570771-13324-4-git-send-email-matt@codeblueprint.co.uk Signed-off-by: Ingo Molnar <mingo@kernel.org>
Diffstat (limited to 'fs/efivarfs')
0 files changed, 0 insertions, 0 deletions