All of lore.kernel.org
 help / color / mirror / Atom feed
From: Colin King <colin.king@canonical.com>
To: "Rafael J . Wysocki" <rjw@rjwysocki.net>,
	Len Brown <lenb@kernel.org>,
	Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	Keith Busch <keith.busch@intel.com>,
	linux-acpi@vger.kernel.org
Cc: kernel-janitors@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: [PATCH][next] acpi/hmat: fix uninitialized pointer dereference on pointer 'target'
Date: Fri,  5 Apr 2019 15:12:15 +0100	[thread overview]
Message-ID: <20190405141215.2079-1-colin.king@canonical.com> (raw)

From: Colin Ian King <colin.king@canonical.com>

The pointer 'target' is not initialized and is only assigned when the
ACPI_HMAT_MEMORY_PD_VALID bit in p->flags is set.  There is a later null
check on target that leads to an uninitialized pointer read and
dereference when assigning target->processor_pxm when target contains a
non-null garbage value.  Fix this by initializing targer to null.

Fixes: 665ac7e92757 ("acpi/hmat: Register processor domain to its memory")
Addresses-Coverity: ("Uninitialized pointer read")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
---
 drivers/acpi/hmat/hmat.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/acpi/hmat/hmat.c b/drivers/acpi/hmat/hmat.c
index b7824a0309f7..b275016ff648 100644
--- a/drivers/acpi/hmat/hmat.c
+++ b/drivers/acpi/hmat/hmat.c
@@ -366,7 +366,7 @@ static int __init hmat_parse_proximity_domain(union acpi_subtable_headers *heade
 					      const unsigned long end)
 {
 	struct acpi_hmat_proximity_domain *p = (void *)header;
-	struct memory_target *target;
+	struct memory_target *target = NULL;
 
 	if (p->header.length != sizeof(*p)) {
 		pr_notice("HMAT: Unexpected address range header length: %d\n",
-- 
2.20.1

WARNING: multiple messages have this Message-ID (diff)
From: Colin King <colin.king@canonical.com>
To: "Rafael J . Wysocki" <rjw@rjwysocki.net>,
	Len Brown <lenb@kernel.org>,
	Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	Keith Busch <keith.busch@intel.com>,
	linux-acpi@vger.kernel.org
Cc: kernel-janitors@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: [PATCH][next] acpi/hmat: fix uninitialized pointer dereference on pointer 'target'
Date: Fri, 05 Apr 2019 14:12:15 +0000	[thread overview]
Message-ID: <20190405141215.2079-1-colin.king@canonical.com> (raw)

From: Colin Ian King <colin.king@canonical.com>

The pointer 'target' is not initialized and is only assigned when the
ACPI_HMAT_MEMORY_PD_VALID bit in p->flags is set.  There is a later null
check on target that leads to an uninitialized pointer read and
dereference when assigning target->processor_pxm when target contains a
non-null garbage value.  Fix this by initializing targer to null.

Fixes: 665ac7e92757 ("acpi/hmat: Register processor domain to its memory")
Addresses-Coverity: ("Uninitialized pointer read")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
---
 drivers/acpi/hmat/hmat.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/acpi/hmat/hmat.c b/drivers/acpi/hmat/hmat.c
index b7824a0309f7..b275016ff648 100644
--- a/drivers/acpi/hmat/hmat.c
+++ b/drivers/acpi/hmat/hmat.c
@@ -366,7 +366,7 @@ static int __init hmat_parse_proximity_domain(union acpi_subtable_headers *heade
 					      const unsigned long end)
 {
 	struct acpi_hmat_proximity_domain *p = (void *)header;
-	struct memory_target *target;
+	struct memory_target *target = NULL;
 
 	if (p->header.length != sizeof(*p)) {
 		pr_notice("HMAT: Unexpected address range header length: %d\n",
-- 
2.20.1

             reply	other threads:[~2019-04-05 14:12 UTC|newest]

Thread overview: 10+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-04-05 14:12 Colin King [this message]
2019-04-05 14:12 ` [PATCH][next] acpi/hmat: fix uninitialized pointer dereference on pointer 'target' Colin King
2019-04-05 15:38 ` Keith Busch
2019-04-05 15:38   ` Keith Busch
2019-04-05 16:06 ` Mukesh Ojha
2019-04-05 16:18   ` Mukesh Ojha
2019-04-09  3:28 ` Nathan Chancellor
2019-04-09  3:28   ` Nathan Chancellor
2019-04-09  7:51 ` Rafael J. Wysocki
2019-04-09  7:51   ` Rafael J. Wysocki

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20190405141215.2079-1-colin.king@canonical.com \
    --to=colin.king@canonical.com \
    --cc=gregkh@linuxfoundation.org \
    --cc=keith.busch@intel.com \
    --cc=kernel-janitors@vger.kernel.org \
    --cc=lenb@kernel.org \
    --cc=linux-acpi@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=rjw@rjwysocki.net \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.