lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

[SCSI] Fix issue reported by coverity in drivers/scsi/scsi_ioctl.c

Browse Source 
This patch attempts to fix an issue found in drivers/scsi/scsi_ioctl.c by Coverity.

Error reported:
CID: 3437
Checker: FORWARD_NULL (help)
File: /export2/p4-coverity/mc2/linux26/drivers/scsi/scsi_ioctl.c
Function: scsi_ioctl_send_command
Description: Variable "buf" tracked as NULL was passed to a function that dereferences it.

Patch description:
buf can be NULL if inlen and outlen are both 0. This patch adds check if the
length is non-zero before calling copy from/to user.

Signed-off-by: Jayachandran C. <c.jayachandran@gmail.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
This commit is contained in:
Jayachandran C
2005-10-27 15:51:13 -07:00
committed by James Bottomley
parent b514112802
commit 4647722673
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/scsi/scsi_ioctl.c
View File

@@ -278,7 +278,7 @@ int scsi_ioctl_send_command(struct scsi_device *sdev,
* Obtain the data to be sent to the device (if any). * Obtain the data to be sent to the device (if any).
*/ */
if(copy_from_user(buf, cmd_in + cmdlen, inlen)) if(inlen && copy_from_user(buf, cmd_in + cmdlen, inlen))
goto error; goto error;
switch (opcode) { switch (opcode) {
@@ -322,7 +322,7 @@ int scsi_ioctl_send_command(struct scsi_device *sdev,
if (copy_to_user(cmd_in, sense, sb_len)) if (copy_to_user(cmd_in, sense, sb_len))
result = -EFAULT; result = -EFAULT;
} else { } else {
if (copy_to_user(cmd_in, buf, outlen)) if (outlen && copy_to_user(cmd_in, buf, outlen))
result = -EFAULT; result = -EFAULT;
} }