diff options
| author | gordon <gordon@FreeBSD.org> | 2018-05-08 17:14:54 +0000 |
|---|---|---|
| committer | gordon <gordon@FreeBSD.org> | 2018-05-08 17:14:54 +0000 |
| commit | 9d2807bdf72c932cabb0bf577328a5ba0eff42af (patch) | |
| tree | bc9d33b202825d3a66a1680abad21dc91f53d478 /sys/dev | |
| parent | cbb1d33b29d7f60ebcbec4611e41b37b34fa25a5 (diff) | |
| download | FreeBSD-src-9d2807bdf72c932cabb0bf577328a5ba0eff42af.zip FreeBSD-src-9d2807bdf72c932cabb0bf577328a5ba0eff42af.tar.gz | |
Fix multiple small kernel memory disclosures. [EN-18:05.mem]
Approved by: so
Security: CVE-2018-6920
Security: CVE-2018-6921
Security: FreeBSD-EN-18:05.mem
Diffstat (limited to 'sys/dev')
| -rw-r--r-- | sys/dev/ath/if_ath_btcoex.c | 3 | ||||
| -rw-r--r-- | sys/dev/ath/if_ath_ioctl.c | 2 | ||||
| -rw-r--r-- | sys/dev/ath/if_ath_lna_div.c | 3 | ||||
| -rw-r--r-- | sys/dev/ath/if_ath_spectral.c | 3 |
4 files changed, 7 insertions, 4 deletions
diff --git a/sys/dev/ath/if_ath_btcoex.c b/sys/dev/ath/if_ath_btcoex.c index f071fc4..002483a 100644 --- a/sys/dev/ath/if_ath_btcoex.c +++ b/sys/dev/ath/if_ath_btcoex.c @@ -457,7 +457,7 @@ ath_btcoex_ioctl(struct ath_softc *sc, struct ath_diag *ad) * pointer for us to use below in reclaiming the buffer; * may want to be more defensive. */ - outdata = malloc(outsize, M_TEMP, M_NOWAIT); + outdata = malloc(outsize, M_TEMP, M_NOWAIT | M_ZERO); if (outdata == NULL) { error = ENOMEM; goto bad; @@ -466,6 +466,7 @@ ath_btcoex_ioctl(struct ath_softc *sc, struct ath_diag *ad) switch (id) { default: error = EINVAL; + goto bad; } if (outsize < ad->ad_out_size) ad->ad_out_size = outsize; diff --git a/sys/dev/ath/if_ath_ioctl.c b/sys/dev/ath/if_ath_ioctl.c index 1128c18..73c1ca2 100644 --- a/sys/dev/ath/if_ath_ioctl.c +++ b/sys/dev/ath/if_ath_ioctl.c @@ -197,7 +197,7 @@ ath_ioctl_diag(struct ath_softc *sc, struct ath_diag *ad) * pointer for us to use below in reclaiming the buffer; * may want to be more defensive. */ - outdata = malloc(outsize, M_TEMP, M_NOWAIT); + outdata = malloc(outsize, M_TEMP, M_NOWAIT | M_ZERO); if (outdata == NULL) { error = ENOMEM; goto bad; diff --git a/sys/dev/ath/if_ath_lna_div.c b/sys/dev/ath/if_ath_lna_div.c index 5c102fb..ec85924 100644 --- a/sys/dev/ath/if_ath_lna_div.c +++ b/sys/dev/ath/if_ath_lna_div.c @@ -187,7 +187,7 @@ ath_lna_div_ioctl(struct ath_softc *sc, struct ath_diag *ad) * pointer for us to use below in reclaiming the buffer; * may want to be more defensive. */ - outdata = malloc(outsize, M_TEMP, M_NOWAIT); + outdata = malloc(outsize, M_TEMP, M_NOWAIT | M_ZERO); if (outdata == NULL) { error = ENOMEM; goto bad; @@ -196,6 +196,7 @@ ath_lna_div_ioctl(struct ath_softc *sc, struct ath_diag *ad) switch (id) { default: error = EINVAL; + goto bad; } if (outsize < ad->ad_out_size) ad->ad_out_size = outsize; diff --git a/sys/dev/ath/if_ath_spectral.c b/sys/dev/ath/if_ath_spectral.c index e4afdae..d8f9e8a 100644 --- a/sys/dev/ath/if_ath_spectral.c +++ b/sys/dev/ath/if_ath_spectral.c @@ -212,7 +212,7 @@ ath_ioctl_spectral(struct ath_softc *sc, struct ath_diag *ad) * pointer for us to use below in reclaiming the buffer; * may want to be more defensive. */ - outdata = malloc(outsize, M_TEMP, M_NOWAIT); + outdata = malloc(outsize, M_TEMP, M_NOWAIT | M_ZERO); if (outdata == NULL) { error = ENOMEM; goto bad; @@ -275,6 +275,7 @@ ath_ioctl_spectral(struct ath_softc *sc, struct ath_diag *ad) break; default: error = EINVAL; + goto bad; } if (outsize < ad->ad_out_size) ad->ad_out_size = outsize; |
