From 3019f2bf08a3e9a0f8ab1b8bbbed5717e677db25 Mon Sep 17 00:00:00 2001 From: Bill Paul Date: Fri, 3 Nov 2000 00:03:03 +0000 Subject: [PATCH] Grrrr. Remember to bzero() the mediainfo structures after we allocate them. If we leave garbage in them, the dc_apply_fixup() routine may try to follow bogus pointers when applying the reset fixup. Noticed by: Andrew Gallatin --- sys/dev/dc/if_dc.c | 3 +++ sys/pci/if_dc.c | 3 +++ 2 files changed, 6 insertions(+) diff --git a/sys/dev/dc/if_dc.c b/sys/dev/dc/if_dc.c index 0d3f6526bad..ad53f89ab3d 100644 --- a/sys/dev/dc/if_dc.c +++ b/sys/dev/dc/if_dc.c @@ -1635,6 +1635,7 @@ static void dc_decode_leaf_sia(sc, l) struct dc_mediainfo *m; m = malloc(sizeof(struct dc_mediainfo), M_DEVBUF, M_NOWAIT); + bzero(m, sizeof(struct dc_mediainfo)); if (l->dc_sia_code == DC_SIA_CODE_10BT) m->dc_media = IFM_10_T; @@ -1665,6 +1666,7 @@ static void dc_decode_leaf_sym(sc, l) struct dc_mediainfo *m; m = malloc(sizeof(struct dc_mediainfo), M_DEVBUF, M_NOWAIT); + bzero(m, sizeof(struct dc_mediainfo)); if (l->dc_sym_code == DC_SYM_CODE_100BT) m->dc_media = IFM_100_TX; @@ -1690,6 +1692,7 @@ static void dc_decode_leaf_mii(sc, l) struct dc_mediainfo *m; m = malloc(sizeof(struct dc_mediainfo), M_DEVBUF, M_NOWAIT); + bzero(m, sizeof(struct dc_mediainfo)); /* We abuse IFM_AUTO to represent MII. */ m->dc_media = IFM_AUTO; m->dc_gp_len = l->dc_gpr_len; diff --git a/sys/pci/if_dc.c b/sys/pci/if_dc.c index 0d3f6526bad..ad53f89ab3d 100644 --- a/sys/pci/if_dc.c +++ b/sys/pci/if_dc.c @@ -1635,6 +1635,7 @@ static void dc_decode_leaf_sia(sc, l) struct dc_mediainfo *m; m = malloc(sizeof(struct dc_mediainfo), M_DEVBUF, M_NOWAIT); + bzero(m, sizeof(struct dc_mediainfo)); if (l->dc_sia_code == DC_SIA_CODE_10BT) m->dc_media = IFM_10_T; @@ -1665,6 +1666,7 @@ static void dc_decode_leaf_sym(sc, l) struct dc_mediainfo *m; m = malloc(sizeof(struct dc_mediainfo), M_DEVBUF, M_NOWAIT); + bzero(m, sizeof(struct dc_mediainfo)); if (l->dc_sym_code == DC_SYM_CODE_100BT) m->dc_media = IFM_100_TX; @@ -1690,6 +1692,7 @@ static void dc_decode_leaf_mii(sc, l) struct dc_mediainfo *m; m = malloc(sizeof(struct dc_mediainfo), M_DEVBUF, M_NOWAIT); + bzero(m, sizeof(struct dc_mediainfo)); /* We abuse IFM_AUTO to represent MII. */ m->dc_media = IFM_AUTO; m->dc_gp_len = l->dc_gpr_len;