aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/scsi/scsi_ioctl.c
diff options
context:
space:
mode:
authorJayachandran C <jchandra@digeo.com>2005-10-27 18:51:13 -0400
committerJames Bottomley <jejb@mulgrave.(none)>2005-10-28 18:41:39 -0400
commit4647722673994787bfa294a163fcb6955b93d417 (patch)
treef355d7d95ca0493ed4181a9517315d9b1db3c418 /drivers/scsi/scsi_ioctl.c
parentb5141128027c53b8ca40736d969f75c9a1cdb64b (diff)
[SCSI] Fix issue reported by coverity in drivers/scsi/scsi_ioctl.c
This patch attempts to fix an issue found in drivers/scsi/scsi_ioctl.c by Coverity. Error reported: CID: 3437 Checker: FORWARD_NULL (help) File: /export2/p4-coverity/mc2/linux26/drivers/scsi/scsi_ioctl.c Function: scsi_ioctl_send_command Description: Variable "buf" tracked as NULL was passed to a function that dereferences it. Patch description: buf can be NULL if inlen and outlen are both 0. This patch adds check if the length is non-zero before calling copy from/to user. Signed-off-by: Jayachandran C. <c.jayachandran@gmail.com> Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
Diffstat (limited to 'drivers/scsi/scsi_ioctl.c')
-rw-r--r--drivers/scsi/scsi_ioctl.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/scsi/scsi_ioctl.c b/drivers/scsi/scsi_ioctl.c
index 26f5bc6d9c82..0bba7d8eebb0 100644
--- a/drivers/scsi/scsi_ioctl.c
+++ b/drivers/scsi/scsi_ioctl.c
@@ -278,7 +278,7 @@ int scsi_ioctl_send_command(struct scsi_device *sdev,
278 * Obtain the data to be sent to the device (if any). 278 * Obtain the data to be sent to the device (if any).
279 */ 279 */
280 280
281 if(copy_from_user(buf, cmd_in + cmdlen, inlen)) 281 if(inlen && copy_from_user(buf, cmd_in + cmdlen, inlen))
282 goto error; 282 goto error;
283 283
284 switch (opcode) { 284 switch (opcode) {
@@ -322,7 +322,7 @@ int scsi_ioctl_send_command(struct scsi_device *sdev,
322 if (copy_to_user(cmd_in, sense, sb_len)) 322 if (copy_to_user(cmd_in, sense, sb_len))
323 result = -EFAULT; 323 result = -EFAULT;
324 } else { 324 } else {
325 if (copy_to_user(cmd_in, buf, outlen)) 325 if (outlen && copy_to_user(cmd_in, buf, outlen))
326 result = -EFAULT; 326 result = -EFAULT;
327 } 327 }
328 328