* [PATCH RESEND] mtip32xx: fix potential crash on SEC_ERASE_UNIT
@ 2012-10-25 14:12 Alan Cox
0 siblings, 0 replies; only message in thread
From: Alan Cox @ 2012-10-25 14:12 UTC (permalink / raw)
To: smain, linux-kernel
(Resending to the list as the maintainer is not responding to direct email)
From: Alan Cox <alan@linux.intel.com>
The mtip driver lifted this code from elsewhere and then added a special
handling check for SEC_ERASE_UNIT. If the caller tries to do a security
erase but passes no output data for the command then outbuf is not
allocated and the driver duly explodes.
Signed-off-by: Alan Cox <alan@linux.intel.com>
---
drivers/block/mtip32xx/mtip32xx.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/block/mtip32xx/mtip32xx.c b/drivers/block/mtip32xx/mtip32xx.c
index adc6f36..d11e9e7 100644
--- a/drivers/block/mtip32xx/mtip32xx.c
+++ b/drivers/block/mtip32xx/mtip32xx.c
@@ -2218,8 +2218,8 @@ static int exec_drive_taskfile(struct driver_data *dd,
fis.device);
/* check for erase mode support during secure erase.*/
- if ((fis.command == ATA_CMD_SEC_ERASE_UNIT)
- && (outbuf[0] & MTIP_SEC_ERASE_MODE)) {
+ if (fis.command == ATA_CMD_SEC_ERASE_UNIT && outbuf &&
+ (outbuf[0] & MTIP_SEC_ERASE_MODE)) {
erasemode = 1;
}
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2012-10-25 14:10 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2012-10-25 14:12 [PATCH RESEND] mtip32xx: fix potential crash on SEC_ERASE_UNIT Alan Cox
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.