From patchwork Wed Nov 18 07:35:17 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Leizhen \(ThunderTown\)" X-Patchwork-Id: 325535 Delivered-To: patch@linaro.org Received: by 2002:a05:6e02:5ce:0:0:0:0 with SMTP id l14csp111932ils; Tue, 17 Nov 2020 23:38:08 -0800 (PST) X-Google-Smtp-Source: ABdhPJxFmaFsoEYfZPsYGPRWDszzNuieW/4j/I7MfHWoe2uZzL1AOb7h2GGL1MF+NKJ5kPfAaQPx X-Received: by 2002:a17:906:b53:: with SMTP id v19mr22143604ejg.136.1605685088256; Tue, 17 Nov 2020 23:38:08 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1605685088; cv=none; d=google.com; s=arc-20160816; b=YvfxzYnX99I3uTsj0GrZGxsMp8jpVNqVy80c/uneKC3Tb7dbytlahRbRroElHFJLwO YnbxIpeEtWPlUWu66FD4IbwUWYIAiyiLbDRruvNtUxLVMBhbDo55f75F8xTadnVSjV9m 4kCxjOoJ5bZkOy9Mdim/ZV2ERDjb26Awdvv/P8B8gWYY2pQTQQ2z6/EfHxT5HExhAIf7 kLH+fnT8yHxD/yqCjwsxmfwyph+FUyO55tFhzOJ2itC0NWoxHypCBwT9nsybXfMCPF5Z hfM8i/WNA70mrqDLkwRbvGk0yo2rBiw6bBmdkcKPEijXLH9096LDoZDFouAZ8KDitkiE IMmA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from; bh=UdV4Y51MFFOeDm9tt/QM9T7vTpMParsmfIj8wZwAZ7o=; b=iPNGBxMMvlCWDcsLzQ8z3XUwWk9aqFhtPnlHeBgTLQbZm2qQxFyH1I/p97yxChkAhz zS5EEaO2rPZN5Am9ybyZFksKFEEpVBshq1N4b6xMdoZVsnS1Im+xgyxZMwSpU7dNFDo8 i279iWMovVstNxBIYBVCSt+S8RjYrvIxA7iKcQRbKDXgpJOoImj3/eGSbjQNH/nXVOHQ gvbnyimlmIdtJrmACyKYzMbT5PwEkrFr5aaCzWLQVpmJtUhLxQtUdcIefJStKZ1wwYhw PchaUAfvTZS6Qf9PdAvgavQkkeT5urjCvZsGyg7ZnLJCMCXELEUFMOiuylePG5e67eNr CaHA== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-acpi-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-acpi-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id gt36si254159ejc.37.2020.11.17.23.38.07; Tue, 17 Nov 2020 23:38:08 -0800 (PST) Received-SPF: pass (google.com: domain of linux-acpi-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-acpi-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-acpi-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1725772AbgKRHgl (ORCPT + 5 others); Wed, 18 Nov 2020 02:36:41 -0500 Received: from szxga04-in.huawei.com ([45.249.212.190]:7645 "EHLO szxga04-in.huawei.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725794AbgKRHgl (ORCPT ); Wed, 18 Nov 2020 02:36:41 -0500 Received: from DGGEMS412-HUB.china.huawei.com (unknown [172.30.72.59]) by szxga04-in.huawei.com (SkyGuard) with ESMTP id 4CbZP56gTbz15MsB; Wed, 18 Nov 2020 15:36:09 +0800 (CST) Received: from thunder-town.china.huawei.com (10.174.176.144) by DGGEMS412-HUB.china.huawei.com (10.3.19.212) with Microsoft SMTP Server id 14.3.487.0; Wed, 18 Nov 2020 15:36:13 +0800 From: Zhen Lei To: Dan Williams , Vishal Verma , Dave Jiang , Ira Weiny , "Rafael J . Wysocki" , Len Brown , linux-nvdimm , linux-acpi , linux-kernel CC: Zhen Lei Subject: [PATCH 1/1] ACPI/nfit: avoid accessing uninitialized memory in acpi_nfit_ctl() Date: Wed, 18 Nov 2020 15:35:17 +0800 Message-ID: <20201118073517.1884-1-thunder.leizhen@huawei.com> X-Mailer: git-send-email 2.26.0.windows.1 MIME-Version: 1.0 X-Originating-IP: [10.174.176.144] X-CFilter-Loop: Reflected Precedence: bulk List-ID: X-Mailing-List: linux-acpi@vger.kernel.org The ACPI_ALLOCATE() does not zero the "buf", so when the condition "integer->type != ACPI_TYPE_INTEGER" in int_to_buf() is met, the result is unpredictable in acpi_nfit_ctl(). Signed-off-by: Zhen Lei --- drivers/acpi/nfit/core.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) -- 2.26.0.106.g9fadedd Reviewed-by: Dan Williams diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c index 442608220b5c..cda7b6c52504 100644 --- a/drivers/acpi/nfit/core.c +++ b/drivers/acpi/nfit/core.c @@ -282,18 +282,19 @@ static union acpi_object *pkg_to_buf(union acpi_object *pkg) static union acpi_object *int_to_buf(union acpi_object *integer) { - union acpi_object *buf = ACPI_ALLOCATE(sizeof(*buf) + 4); + union acpi_object *buf = NULL; void *dst = NULL; - if (!buf) - goto err; - if (integer->type != ACPI_TYPE_INTEGER) { WARN_ONCE(1, "BIOS bug, unexpected element type: %d\n", integer->type); goto err; } + buf = ACPI_ALLOCATE(sizeof(*buf) + 4); + if (!buf) + goto err; + dst = buf + 1; buf->type = ACPI_TYPE_BUFFER; buf->buffer.length = 4;