linux-kernel - [PATCH v1] ACPI: processor_pdc: Fix uninitialized access of buf

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20230914222527.3472379-1-michal.wilczynski@intel.com>
Date:   Fri, 15 Sep 2023 01:25:27 +0300
From:   Michal Wilczynski <michal.wilczynski@...el.com>
To:     linux-acpi@...r.kernel.org
Cc:     rafael@...nel.org, linux-kernel@...r.kernel.org, lenb@...nel.org,
        Michal Wilczynski <michal.wilczynski@...el.com>
Subject: [PATCH v1] ACPI: processor_pdc: Fix uninitialized access of buf

Bug was introduced during unification of setting CAP_SMP_T_SWCOORD for
_PDC and _OSC methods. Third u32 in buffer is never being zero-ed before
setting bits on it. The memory is not guaranteed to be zero as it was
allocated by kmalloc() instead of kzalloc(). Fix this by initializing
third u32 in buffer to 0.

Fixes: b9e8d0168a7a ("ACPI: processor: Set CAP_SMP_T_SWCOORD in arch_acpi_set_proc_cap_bits()")
Signed-off-by: Michal Wilczynski <michal.wilczynski@...el.com>
---
 drivers/acpi/processor_pdc.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/acpi/processor_pdc.c b/drivers/acpi/processor_pdc.c
index 1a8591e9a9bf..994091bd52de 100644
--- a/drivers/acpi/processor_pdc.c
+++ b/drivers/acpi/processor_pdc.c
@@ -19,6 +19,7 @@ static void acpi_set_pdc_bits(u32 *buf)
 {
 	buf[0] = ACPI_PDC_REVISION_ID;
 	buf[1] = 1;
+	buf[2] = 0;
 
 	/* Twiddle arch-specific bits needed for _PDC */
 	arch_acpi_set_proc_cap_bits(&buf[2]);
-- 
2.41.0