[PATCH] ipmi: Fix kernel panic at ipmi_ssif_thread()

Path	csiph.com!1.us.feeder.erje.net!2.us.feeder.erje.net!feeder.erje.net!1.eu.feeder.erje.net!weretis.net!feeder4.news.weretis.net!news.unit0.net!news.panservice.it!bofh.it!news.nic.it!robomod
From	Joeseph Chang <joechang@codeaurora.org>
Newsgroups	linux.kernel
Subject	[PATCH] ipmi: Fix kernel panic at ipmi_ssif_thread()
Date	Tue, 28 Mar 2017 04:30:02 +0200
Message-ID	<tpP3s-Sl-3@gated-at.bofh.it> (permalink)
X-Ironport-Av	E=Sophos;i="5.36,234,1486454400"; d="scan'208";a="368755624"
X-Ironport-Av	E=McAfee;i="5800,7501,8480"; a="1335778140"
X-Mga-Submission	MDEJTtTXSm0yeY1d72xdPPcpEcbzNyGRz6h+mrK5bH3k2DrAiltkvHrPz9NkPGRSCRul2ehI2QfjYhL5Omn+DHwpHwD/K0czXvbfpotKq4iuxxLAA8LVBujD/0QbCxhNbNIyOLxQAgWRLjZfw0/dlJmH
X-Mailer	git-send-email 1.9.1
Sender	robomod@news.nic.it
List-ID	<linux-kernel.vger.kernel.org>
X-Mailing-List	linux-kernel@vger.kernel.org
Approved	robomod@news.nic.it
Lines	45
Organization	linux.* mail to news gateway
X-Original-Cc	anjiandi@codeaurora.org
X-Original-Date	Mon, 27 Mar 2017 20:22:09 -0600
X-Original-Message-ID	<1490667729-18129-1-git-send-email-joechang@codeaurora.org>
X-Original-Sender	linux-kernel-owner@vger.kernel.org
Xref	csiph.com linux.kernel:1610263

Show key headers only | View raw

Signed-off-by: Joeseph Chang <joechang@codeaurora.org>
---
ipmi: Fix kernel panic at ipmi_ssif_thread()

msg_written_handler() may set ssif_info->multi_data to NULL
when using ipmitool to write fru.

Before setting ssif_info->multi_data to NULL, add new local
pointer "data_to_send" and store correct i2c data pointer to
it to fix NULL pointer kernel panic and incorrect ssif_info->multi_pos.

 drivers/char/ipmi/ipmi_ssif.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c
index cca6e5b..51ba67d 100644
--- a/drivers/char/ipmi/ipmi_ssif.c
+++ b/drivers/char/ipmi/ipmi_ssif.c
@@ -891,6 +891,7 @@ static void msg_written_handler(struct ssif_info *ssif_info, int result,
 		 * for details on the intricacies of this.
 		 */
 		int left;
+		unsigned char *data_to_send;
 
 		ssif_inc_stat(ssif_info, sent_messages_parts);
 
@@ -899,6 +900,7 @@ static void msg_written_handler(struct ssif_info *ssif_info, int result,
 			left = 32;
 		/* Length byte. */
 		ssif_info->multi_data[ssif_info->multi_pos] = left;
+		data_to_send = ssif_info->multi_data + ssif_info->multi_pos;
 		ssif_info->multi_pos += left;
 		if (left < 32)
 			/*
@@ -912,7 +914,7 @@ static void msg_written_handler(struct ssif_info *ssif_info, int result,
 		rv = ssif_i2c_send(ssif_info, msg_written_handler,
 				  I2C_SMBUS_WRITE,
 				  SSIF_IPMI_MULTI_PART_REQUEST_MIDDLE,
-				  ssif_info->multi_data + ssif_info->multi_pos,
+				  data_to_send,
 				  I2C_SMBUS_BLOCK_DATA);
 		if (rv < 0) {
 			/* request failed, just return the error. */
-- 
1.9.1

Back to linux.kernel | Previous | Next | Find similar | Unroll thread

Thread

[PATCH] ipmi: Fix kernel panic at ipmi_ssif_thread() Joeseph Chang <joechang@codeaurora.org> - 2017-03-28 04:30 +0200

csiph-web