Grrrr. Remember to bzero() the mediainfo structures after we allocate

them. If we leave garbage in them, the dc_apply_fixup() routine may
try to follow bogus pointers when applying the reset fixup.

Noticed by: Andrew Gallatin

1 files changed, 3 insertions, 0 deletions

diff --git a/sys/pci/if_dc.c b/sys/pci/if_dc.c
index 0d3f652..ad53f89 100644
--- a/sys/pci/if_dc.c
+++ b/sys/pci/if_dc.c
@@ -1635,6 +1635,7 @@ static void dc_decode_leaf_sia(sc, l)
 	struct dc_mediainfo	*m;
 
 	m = malloc(sizeof(struct dc_mediainfo), M_DEVBUF, M_NOWAIT);
+	bzero(m, sizeof(struct dc_mediainfo));
 	if (l->dc_sia_code == DC_SIA_CODE_10BT)
 		m->dc_media = IFM_10_T;
 
@@ -1665,6 +1666,7 @@ static void dc_decode_leaf_sym(sc, l)
 	struct dc_mediainfo	*m;
 
 	m = malloc(sizeof(struct dc_mediainfo), M_DEVBUF, M_NOWAIT);
+	bzero(m, sizeof(struct dc_mediainfo));
 	if (l->dc_sym_code == DC_SYM_CODE_100BT)
 		m->dc_media = IFM_100_TX;
 
@@ -1690,6 +1692,7 @@ static void dc_decode_leaf_mii(sc, l)
 	struct dc_mediainfo	*m;
 
 	m = malloc(sizeof(struct dc_mediainfo), M_DEVBUF, M_NOWAIT);
+	bzero(m, sizeof(struct dc_mediainfo));
 	/* We abuse IFM_AUTO to represent MII. */
 	m->dc_media = IFM_AUTO;
 	m->dc_gp_len = l->dc_gpr_len;