From: Ben Hutchings <ben@decadent.org.uk>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: akpm@linux-foundation.org, "Matt Fleming" <matt.fleming@intel.com>
Subject: [09/26] x86/efi: Fix dummy variable buffer allocation
Date: Wed, 26 Jun 2013 03:35:58 +0100 [thread overview]
Message-ID: <lsq.1372214158.331667502@decadent.org.uk> (raw)
In-Reply-To: <lsq.1372214158.425780530@decadent.org.uk>
3.2.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Ben Hutchings <ben@decadent.org.uk>
commit b8cb62f82103083a6e8fa5470bfe634a2c06514d upstream.
1. Check for allocation failure
2. Clear the buffer contents, as they may actually be written to flash
3. Don't leak the buffer
Compile-tested only.
[ Tested successfully on my buggy ASUS machine - Matt ]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Matt Fleming <matt.fleming@intel.com>
---
arch/x86/platform/efi/efi.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
--- a/arch/x86/platform/efi/efi.c
+++ b/arch/x86/platform/efi/efi.c
@@ -875,7 +875,10 @@ efi_status_t efi_query_variable_store(u3
* that by attempting to use more space than is available.
*/
unsigned long dummy_size = remaining_size + 1024;
- void *dummy = kmalloc(dummy_size, GFP_ATOMIC);
+ void *dummy = kzalloc(dummy_size, GFP_ATOMIC);
+
+ if (!dummy)
+ return EFI_OUT_OF_RESOURCES;
status = efi.set_variable(efi_dummy_name, &EFI_DUMMY_GUID,
EFI_VARIABLE_NON_VOLATILE |
@@ -895,6 +898,8 @@ efi_status_t efi_query_variable_store(u3
0, dummy);
}
+ kfree(dummy);
+
/*
* The runtime code may now have triggered a garbage collection
* run, so check the variable info again
next prev parent reply other threads:[~2013-06-26 2:48 UTC|newest]
Thread overview: 35+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-06-26 2:35 [00/26] 3.2.48-rc1 review Ben Hutchings
2013-06-26 2:35 ` [04/26] ARM: 7755/1: handle user space mapped pages in flush_kernel_dcache_page Ben Hutchings
2013-06-26 9:04 ` Luis Henriques
2013-06-26 22:35 ` Simon Baatz
2013-06-27 8:21 ` Luis Henriques
2013-06-29 3:01 ` Ben Hutchings
2013-06-26 2:35 ` [02/26] ALSA: usb-audio: work around Android accessory firmware bug Ben Hutchings
2013-06-26 2:35 ` [01/26] tilepro: work around module link error with gcc 4.7 Ben Hutchings
2013-06-26 2:35 ` [17/26] tcp: xps: fix reordering issues Ben Hutchings
2013-06-26 2:35 ` Ben Hutchings [this message]
2013-06-26 2:35 ` [12/26] tcp: fix tcp_md5_hash_skb_data() Ben Hutchings
2013-06-26 2:35 ` [11/26] virtio-blk: Call revalidate_disk() upon online disk resize Ben Hutchings
2013-06-26 2:35 ` [19/26] net: Block MSG_CMSG_COMPAT in send(m)msg and recv(m)msg Ben Hutchings
2013-06-26 2:35 ` [07/26] USB: serial: ti_usb_3410_5052: new device id for Abbot strip port cable Ben Hutchings
2013-06-26 8:21 ` Anders Hammarquist
2013-06-26 17:22 ` Greg Kroah-Hartman
2013-06-26 2:35 ` [16/26] r8169: fix 8168evl frame padding Ben Hutchings
2013-06-26 8:51 ` Stefan Bader
2013-06-26 18:37 ` David Miller
2013-06-26 20:00 ` Stefan Bader
2013-06-26 2:35 ` [10/26] Revert "drm/i915: GFX_MODE Flush TLB Invalidate Mode must be '1' for scanline waits" Ben Hutchings
2013-06-26 2:35 ` [15/26] netlabel: improve domain mapping validation Ben Hutchings
2013-06-26 2:35 ` [03/26] ALSA: usb-audio: Fix invalid volume resolution for Logitech HD Webcam c310 Ben Hutchings
2013-06-26 2:35 ` [18/26] ip_tunnel: fix kernel panic with icmp_dest_unreach Ben Hutchings
2013-06-26 2:35 ` [05/26] KVM: x86: remove vcpu's CPL check in host-invoked XCR set Ben Hutchings
2013-06-26 2:35 ` [14/26] ipv6: fix possible crashes in ip6_cork_release() Ben Hutchings
2013-06-26 2:35 ` [06/26] x86: fix build error and kconfig for ia32_emulation and binfmt Ben Hutchings
2013-06-26 2:35 ` [13/26] gianfar: add missing iounmap() on error in gianfar_ptp_probe() Ben Hutchings
2013-06-26 2:35 ` [23/26] packet: packet_getname_spkt: make sure string is always 0-terminated Ben Hutchings
2013-06-26 2:35 ` [22/26] net: sctp: fix NULL pointer dereference in socket destruction Ben Hutchings
2013-06-26 2:35 ` [24/26] l2tp: Fix PPP header erasure and memory leak Ben Hutchings
2013-06-26 2:35 ` [21/26] ipv6: assign rt6_info to inet6_ifaddr in init_loopback Ben Hutchings
2013-06-26 2:35 ` [25/26] l2tp: Fix sendmsg() return value Ben Hutchings
2013-06-26 2:35 ` [20/26] net: force a reload of first item in hlist_nulls_for_each_entry_rcu Ben Hutchings
2013-06-26 2:35 ` [26/26] ncpfs: fix rmdir returns Device or resource busy Ben Hutchings
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=lsq.1372214158.331667502@decadent.org.uk \
--to=ben@decadent.org.uk \
--cc=akpm@linux-foundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=matt.fleming@intel.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®