ACPI/nfit: avoid accessing uninitialized memory in acpi_nfit_ctl()

The ACPI_ALLOCATE() does not zero the "buf", so when the condition
"integer->type != ACPI_TYPE_INTEGER" in int_to_buf() is met, the result
is unpredictable in acpi_nfit_ctl().

Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
Reviewed-by: Dan Williams <dan.j.williams@intel.com>
Link: https://lore.kernel.org/r/20201118073517.1884-1-thunder.leizhen@huawei.com
Signed-off-by: Dan Williams <dan.j.williams@intel.com>

diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
index 442608220b5c80be7d4b6349dc2e9fa52646dc65..cda7b6c5250497ceb05c6e0440cb6d0c5c81b961 100644 (file)
--- a/drivers/acpi/nfit/core.c
+++ b/drivers/acpi/nfit/core.c
@@ -282,18 +282,19 @@ err:
 
 static union acpi_object *int_to_buf(union acpi_object *integer)
 {
-       union acpi_object *buf = ACPI_ALLOCATE(sizeof(*buf) + 4);
+       union acpi_object *buf = NULL;
        void *dst = NULL;
 
-       if (!buf)
-               goto err;
-
        if (integer->type != ACPI_TYPE_INTEGER) {
                WARN_ONCE(1, "BIOS bug, unexpected element type: %d\n",
                                integer->type);
                goto err;
        }
 
+       buf = ACPI_ALLOCATE(sizeof(*buf) + 4);
+       if (!buf)
+               goto err;
+
        dst = buf + 1;
        buf->type = ACPI_TYPE_BUFFER;
        buf->buffer.length = 4;