diff options
| author | Mark Einon <mark.einon@gmail.com> | 2014-09-23 20:41:11 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2014-09-23 23:38:15 -0700 |
| commit | e112eb598db4fb7b99086c33765cf262dcfda0d2 (patch) | |
| tree | 7bd05407363423ac589e464961befa99a1dde9c6 | |
| parent | bfe945c8e1260e405a7a257719c9e2cf77cafa4e (diff) | |
staging: et131x: zero allocation of fbr to prevent random address access
If et131x_rx_dma_memory_alloc() allocates rx_ring->fbr[0] but fails to
allocate rx_ring->fbr[1], this leaves fbr[0]->ring_virtaddr with the
possibility of being accessed in et131x_rx_dma_memory_free() as it
contains a random value, potentially causing an oops.
Fix this by zeroing the fbr memory on allocation. Subsequent frees of
this fbr memory explicitly zeros the ring_virtaddr value.
Reported-by: Tobias Klauser <tklauser@distanz.ch>
Signed-off-by: Mark Einon <mark.einon@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | drivers/staging/et131x/et131x.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/staging/et131x/et131x.c b/drivers/staging/et131x/et131x.c index 93afd61f33fd..2889f86e6052 100644 --- a/drivers/staging/et131x/et131x.c +++ b/drivers/staging/et131x/et131x.c @@ -2003,10 +2003,10 @@ static int et131x_rx_dma_memory_alloc(struct et131x_adapter *adapter) struct fbr_lookup *fbr; /* Alloc memory for the lookup table */ - rx_ring->fbr[0] = kmalloc(sizeof(*fbr), GFP_KERNEL); + rx_ring->fbr[0] = kzalloc(sizeof(*fbr), GFP_KERNEL); if (rx_ring->fbr[0] == NULL) return -ENOMEM; - rx_ring->fbr[1] = kmalloc(sizeof(*fbr), GFP_KERNEL); + rx_ring->fbr[1] = kzalloc(sizeof(*fbr), GFP_KERNEL); if (rx_ring->fbr[1] == NULL) return -ENOMEM; |