lkml.org 
[lkml]   [2020]   [Mar]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.4 05/72] ipmi:ssif: Handle a possible NULL pointer reference
    Date
    From: Corey Minyard <cminyard@mvista.com>

    [ Upstream commit 6b8526d3abc02c08a2f888e8c20b7ac9e5776dfe ]

    In error cases a NULL can be passed to memcpy. The length will always
    be zero, so it doesn't really matter, but go ahead and check for NULL,
    anyway, to be more precise and avoid static analysis errors.

    Reported-by: kbuild test robot <lkp@intel.com>
    Signed-off-by: Corey Minyard <cminyard@mvista.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/char/ipmi/ipmi_ssif.c | 10 +++++++---
    1 file changed, 7 insertions(+), 3 deletions(-)

    diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c
    index 67d23ed2d1a06..29082d99264e8 100644
    --- a/drivers/char/ipmi/ipmi_ssif.c
    +++ b/drivers/char/ipmi/ipmi_ssif.c
    @@ -742,10 +742,14 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result,
    flags = ipmi_ssif_lock_cond(ssif_info, &oflags);
    msg = ssif_info->curr_msg;
    if (msg) {
    + if (data) {
    + if (len > IPMI_MAX_MSG_LENGTH)
    + len = IPMI_MAX_MSG_LENGTH;
    + memcpy(msg->rsp, data, len);
    + } else {
    + len = 0;
    + }
    msg->rsp_size = len;
    - if (msg->rsp_size > IPMI_MAX_MSG_LENGTH)
    - msg->rsp_size = IPMI_MAX_MSG_LENGTH;
    - memcpy(msg->rsp, data, msg->rsp_size);
    ssif_info->curr_msg = NULL;
    }

    --
    2.20.1


    \
     
     \ /
      Last update: 2020-03-10 14:38    [W:4.561 / U:1.968 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site