Messages in this thread Patch in this message | | | From | Joeseph Chang <> | Subject | [PATCH] ipmi: Fix kernel panic at ipmi_ssif_thread() | Date | Thu, 23 Mar 2017 01:07:12 -0600 |
| |
From: Joeseph Chang <joechang@codeaurora.org>
msg_written_handler() may set ssif_info->multi_data to NULL when using ipmitool to write fru. Change the ssif i2c send data sequence in msg_written_handler() to fix NULL pointer kernel panic and incorrect ssif_info->multi_pos.
Signed-off-by: Joeseph Chang <joechang@codeaurora.org> --- drivers/char/ipmi/ipmi_ssif.c | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-)
diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c index cca6e5b..39346ee 100644 --- a/drivers/char/ipmi/ipmi_ssif.c +++ b/drivers/char/ipmi/ipmi_ssif.c @@ -899,21 +899,13 @@ static void msg_written_handler(struct ssif_info *ssif_info, int result, left = 32; /* Length byte. */ ssif_info->multi_data[ssif_info->multi_pos] = left; - ssif_info->multi_pos += left; - if (left < 32) - /* - * Write is finished. Note that we must end - * with a write of less than 32 bytes to - * complete the transaction, even if it is - * zero bytes. - */ - ssif_info->multi_data = NULL; rv = ssif_i2c_send(ssif_info, msg_written_handler, I2C_SMBUS_WRITE, SSIF_IPMI_MULTI_PART_REQUEST_MIDDLE, ssif_info->multi_data + ssif_info->multi_pos, I2C_SMBUS_BLOCK_DATA); + if (rv < 0) { /* request failed, just return the error. */ ssif_inc_stat(ssif_info, send_errors); @@ -922,6 +914,16 @@ static void msg_written_handler(struct ssif_info *ssif_info, int result, pr_info("Error from i2c_non_blocking_op(3)\n"); msg_done_handler(ssif_info, -EIO, NULL, 0); } + + ssif_info->multi_pos += left; + if (left < 32) + /* + * Write is finished. Note that we must end + * with a write of less than 32 bytes to + * complete the transaction, even if it is + * zero bytes. + */ + ssif_info->multi_data = NULL; } else { /* Ready to request the result. */ unsigned long oflags, *flags; -- 1.9.1
| |