Skip to contentSkip to conversation

- fix possible bug in scsi/sr_ioctl.c.

PATCH New Luiz Fernando N. Capitulino 1 participant 1 message May 26, 2004 SCSI

lore
Share & tools
lore

Luiz Fernando N. Capitulino

author
#0 lore raw

PATCH 1/1 - fix possible bug in scsi/sr_ioctl.c.

Hi,

In scsci/sr_ioctl.c::sr_audio_ioctl() (line 329) there is a
possible bug (found by coverity's checker): if kmalloc() returns NULL, the contents of buffer' will be used in the body of case CDROMREADTOCHDR', and `case CDROMREADTOCENTRY' whitout any memory allocated.

The patch bellow fix that. My suggestion is to put de definition
of buffer' only in the places where it is used, because in case CDROMPLAYTRKIND' don't use it, so it does not need to allocate it.

 drivers/scsi/sr_ioctl.c |   10 ++++++++--
 1 files changed, 8 insertions(+), 2 deletions(-)
drivers/scsi/sr_ioctl.c +8 -2
diff -X dontdiff -Nparu a/drivers/scsi/sr_ioctl.c a~/drivers/scsi/sr_ioctl.c
@@ -329,7 +329,6 @@ int sr_audio_ioctl(struct cdrom_device_i
 	Scsi_CD *cd = cdi->handle;
 	struct cdrom_generic_command cgc;
 	int result;
-	unsigned char *buffer = kmalloc(32, GFP_KERNEL | SR_GFP_DMA(cd));
 
 	memset(&cgc, 0, sizeof(struct cdrom_generic_command));
 	cgc.timeout = IOCTL_TIMEOUT;

@@ -338,6 +337,9 @@ int sr_audio_ioctl(struct cdrom_device_i
 	case CDROMREADTOCHDR:
 		{
 			struct cdrom_tochdr *tochdr = (struct cdrom_tochdr *) arg;
+			unsigned char *buffer = kmalloc(32, GFP_KERNEL | SR_GFP_DMA(cd));
+			if (!buffer)
+				return -ENOMEM;
 
 			cgc.cmd[0] = GPCMD_READ_TOC_PMA_ATIP;
 			cgc.cmd[8] = 12;		/* LSB of length */

@@ -351,12 +353,16 @@ int sr_audio_ioctl(struct cdrom_device_i
 			tochdr->cdth_trk0 = buffer[2];
 			tochdr->cdth_trk1 = buffer[3];
 
+			kfree(buffer);
 			break;
 		}
 
 	case CDROMREADTOCENTRY:
 		{
 			struct cdrom_tocentry *tocentry = (struct cdrom_tocentry *) arg;
+			unsigned char *buffer = kmalloc(32, GFP_KERNEL | SR_GFP_DMA(cd));
+			if (!buffer)
+				return -ENOMEM;
 
 			cgc.cmd[0] = GPCMD_READ_TOC_PMA_ATIP;
 			cgc.cmd[1] |= (tocentry->cdte_format == CDROM_MSF) ? 0x02 : 0;

@@ -379,6 +385,7 @@ int sr_audio_ioctl(struct cdrom_device_i
 				tocentry->cdte_addr.lba = (((((buffer[8] << 8) + buffer[9]) << 8)
 					+ buffer[10]) << 8) + buffer[11];
 
+			kfree(buffer);
 			break;
 		}
 

@@ -408,7 +415,6 @@ int sr_audio_ioctl(struct cdrom_device_i
 		printk("DEBUG: sr_audio: result for ioctl %x: %x\n", cmd, result);
 #endif
 
-	kfree(buffer);
 	return result;
 }
Signature · 2 lines
Luiz Fernando N. Capitulino
<http://www.telecentros.sp.gov.br>