summaryrefslogtreecommitdiffstats
path: root/drivers/scsi/mpt2sas/mpt2sas_ctl.c
diff options
context:
space:
mode:
authornagalakshmi.nandigama@lsi.com <nagalakshmi.nandigama@lsi.com>2012-03-20 12:07:17 +0530
committerJames Bottomley <JBottomley@Parallels.com>2012-04-23 19:27:21 +0100
commit298c794def0631763ec861e641a448c7decf73bb (patch)
treef22b4ccd7cab935907505322dd0eab330c96a480 /drivers/scsi/mpt2sas/mpt2sas_ctl.c
parent09da0b32d078a3b94aa6d948d053b84755712a2b (diff)
downloadlinux-298c794def0631763ec861e641a448c7decf73bb.tar.gz
linux-298c794def0631763ec861e641a448c7decf73bb.tar.bz2
linux-298c794def0631763ec861e641a448c7decf73bb.zip
[SCSI] mpt2sas: Fix security scan issues reported by source code analysis tool
Modified the source code as per the findings reported by the source code analysis tool. Source code for the following functionalities has been touched. None of the driver functionalities has changed. - SMP Passthrough IOCTL - Debug messages for MPT Replies (i.e. bit 9 of Logging Level) - Task Management using sysfs - Device removal, i.e. when a target device (including any PD within a volume) is removed, and Volume Deletion. - Trace Buffer Signed-off-by: Nagalakshmi Nandigama <nagalakshmi.nandigama@lsi.com> Signed-off-by: James Bottomley <JBottomley@Parallels.com>
Diffstat (limited to 'drivers/scsi/mpt2sas/mpt2sas_ctl.c')
-rw-r--r--drivers/scsi/mpt2sas/mpt2sas_ctl.c12
1 files changed, 10 insertions, 2 deletions
diff --git a/drivers/scsi/mpt2sas/mpt2sas_ctl.c b/drivers/scsi/mpt2sas/mpt2sas_ctl.c
index 850bb9da7cd8..49bdd2dc8452 100644
--- a/drivers/scsi/mpt2sas/mpt2sas_ctl.c
+++ b/drivers/scsi/mpt2sas/mpt2sas_ctl.c
@@ -865,8 +865,16 @@ _ctl_do_mpt_command(struct MPT2SAS_ADAPTER *ioc, struct mpt2_ioctl_command karg,
if (smp_request->PassthroughFlags &
MPI2_SMP_PT_REQ_PT_FLAGS_IMMEDIATE)
data = (u8 *)&smp_request->SGL;
- else
+ else {
+ if (unlikely(data_out == NULL)) {
+ printk(KERN_ERR "failure at %s:%d/%s()!\n",
+ __FILE__, __LINE__, __func__);
+ mpt2sas_base_free_smid(ioc, smid);
+ ret = -EINVAL;
+ goto out;
+ }
data = data_out;
+ }
if (data[1] == 0x91 && (data[10] == 1 || data[10] == 2)) {
ioc->ioc_link_reset_in_progress = 1;
@@ -2832,7 +2840,7 @@ _ctl_host_trace_buffer_enable_store(struct device *cdev,
struct mpt2_diag_register diag_register;
u8 issue_reset = 0;
- if (sscanf(buf, "%s", str) != 1)
+ if (sscanf(buf, "%9s", str) != 1)
return -EINVAL;
if (!strcmp(str, "post")) {