diff options
| author | Corey Minyard <[email protected]> | 2019-12-23 10:42:19 -0600 |
|---|---|---|
| committer | Corey Minyard <[email protected]> | 2019-12-23 10:42:19 -0600 |
| commit | 6b8526d3abc02c08a2f888e8c20b7ac9e5776dfe (patch) | |
| tree | e9275170adf2cca9e2458039333dcc69f65a46eb | |
| parent | 380665becdeeb4f455c23582b7f32e6b3cea27d2 (diff) | |
ipmi:ssif: Handle a possible NULL pointer reference
In error cases a NULL can be passed to memcpy. The length will always
be zero, so it doesn't really matter, but go ahead and check for NULL,
anyway, to be more precise and avoid static analysis errors.
Reported-by: kbuild test robot <[email protected]>
Signed-off-by: Corey Minyard <[email protected]>
| -rw-r--r-- | drivers/char/ipmi/ipmi_ssif.c | 10 |
1 files changed, 7 insertions, 3 deletions
diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c index 22c6a2e61236..8ac390c2b514 100644 --- a/drivers/char/ipmi/ipmi_ssif.c +++ b/drivers/char/ipmi/ipmi_ssif.c @@ -775,10 +775,14 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result, flags = ipmi_ssif_lock_cond(ssif_info, &oflags); msg = ssif_info->curr_msg; if (msg) { + if (data) { + if (len > IPMI_MAX_MSG_LENGTH) + len = IPMI_MAX_MSG_LENGTH; + memcpy(msg->rsp, data, len); + } else { + len = 0; + } msg->rsp_size = len; - if (msg->rsp_size > IPMI_MAX_MSG_LENGTH) - msg->rsp_size = IPMI_MAX_MSG_LENGTH; - memcpy(msg->rsp, data, msg->rsp_size); ssif_info->curr_msg = NULL; } |