github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-24 06:24:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

platform/x86: int1092: Fix info leak in parse_package()

Browse Source 
Sashiko reports a possible information leak that can occur as follows:

1. In parse_package(), memory allocated for data->device_mode_info is not
   zerozed initially as it is allocated with devm_kmalloc_array().

2. In the for loop after the allocation, a malformed ACPI package
   provided by firmware can cause some fields in data->device_mode_info
   to remain uninitialized.

3. Later in update_sar_data(), the uninitialized fields gets copied to
   the fields of context->sar_data, which can be exposed to userspace
   through sysfs attribute read (intc_data_show()).

Fix the leak by switching to use devm_kcalloc() for allocation.

Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260710052806.100107-1-nihaal%40cse.iitm.ac.in
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
Link: https://patch.msgid.link/20260723-platx86-v4-2-93b4a178b595@cse.iitm.ac.in
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
This commit is contained in:
Abdun Nihaal 2026-07-23 18:14:16 +05:30 committed by Ilpo Järvinen
parent 30c906cff4
commit f5eb833730
No known key found for this signature in database
GPG Key ID: 59AC4F6153E5CE31
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
drivers/platform/x86/intel/int1092/intel_sar.c
View File

@ -91,10 +91,10 @@ static acpi_status parse_package(struct wwan_sar_context *context, union acpi_ob
item->package.count <= data->total_dev_mode)
return AE_ERROR;
data->device_mode_info = devm_kmalloc_array(&context->sar_device->dev,
data->total_dev_mode,
sizeof(*data->device_mode_info),
GFP_KERNEL);
data->device_mode_info = devm_kcalloc(&context->sar_device->dev,
data->total_dev_mode,
sizeof(*data->device_mode_info),
GFP_KERNEL);
if (!data->device_mode_info)
return AE_ERROR;