⬢ DragonFlyBSD Kernel Audit
DF-5364 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
--- a/sys/bus/pccard/pccard_cis.c
+++ b/sys/bus/pccard/pccard_cis.c
@@ -789,6 +789,11 @@
 		if ((state->pf == NULL) || (state->gotmfc == 2)) {
 			state->pf = kmalloc(sizeof(*state->pf), M_DEVBUF,
 			    M_NOWAIT | M_ZERO);
+			if (state->pf == NULL) {
+				/* DF-5364 */
+				state->card->error++;
+				break;
+			}
 			state->pf->number = state->count++;
 			state->pf->last_config_index = -1;
 			STAILQ_INIT(&state->pf->cfe_head);
@@ -836,6 +841,11 @@
 			if (state->pf == NULL) {
 				state->pf = kmalloc(sizeof(*state->pf),
 				    M_DEVBUF, M_NOWAIT | M_ZERO);
+				if (state->pf == NULL) {
+					/* DF-5364 */
+					state->card->error++;
+					break;
+				}
 				state->pf->number = state->count++;
 				state->pf->last_config_index = -1;
 				STAILQ_INIT(&state->pf->cfe_head);
@@ -875,6 +885,14 @@
 			u_int intface, def, num;
 			u_int power, timing, iospace, irq, memspace, misc;
 			struct pccard_config_entry *cfe;
+
+			/* DF-2319 hardening: never touch default_cfe or
+			 * pf without a CISTPL_CONFIG-allocated pair (also
+			 * covers the DF-5364 break-outs above). */
+			if (state->default_cfe == NULL || state->pf == NULL) {
+				state->card->error++;
+				break;
+			}
 
 			idx = 0;