Commit 21ebc869 authored by Joeseph Chang's avatar Joeseph Chang Committed by Sasha Levin

ipmi: Fix kernel panic at ipmi_ssif_thread()

[ Upstream commit 6de65fcf ]

msg_written_handler() may set ssif_info->multi_data to NULL
when using ipmitool to write fru.

Before setting ssif_info->multi_data to NULL, add new local
pointer "data_to_send" and store correct i2c data pointer to
it to fix NULL pointer kernel panic and incorrect ssif_info->multi_pos.
Signed-off-by: default avatarJoeseph Chang <joechang@codeaurora.org>
Signed-off-by: default avatarCorey Minyard <cminyard@mvista.com>
Cc: stable@vger.kernel.org # 3.19-
Signed-off-by: default avatarSasha Levin <alexander.levin@verizon.com>
parent 82bfc1d9
...@@ -887,6 +887,7 @@ static void msg_written_handler(struct ssif_info *ssif_info, int result, ...@@ -887,6 +887,7 @@ static void msg_written_handler(struct ssif_info *ssif_info, int result,
* for details on the intricacies of this. * for details on the intricacies of this.
*/ */
int left; int left;
unsigned char *data_to_send;
ssif_inc_stat(ssif_info, sent_messages_parts); ssif_inc_stat(ssif_info, sent_messages_parts);
...@@ -895,6 +896,7 @@ static void msg_written_handler(struct ssif_info *ssif_info, int result, ...@@ -895,6 +896,7 @@ static void msg_written_handler(struct ssif_info *ssif_info, int result,
left = 32; left = 32;
/* Length byte. */ /* Length byte. */
ssif_info->multi_data[ssif_info->multi_pos] = left; ssif_info->multi_data[ssif_info->multi_pos] = left;
data_to_send = ssif_info->multi_data + ssif_info->multi_pos;
ssif_info->multi_pos += left; ssif_info->multi_pos += left;
if (left < 32) if (left < 32)
/* /*
...@@ -908,7 +910,7 @@ static void msg_written_handler(struct ssif_info *ssif_info, int result, ...@@ -908,7 +910,7 @@ static void msg_written_handler(struct ssif_info *ssif_info, int result,
rv = ssif_i2c_send(ssif_info, msg_written_handler, rv = ssif_i2c_send(ssif_info, msg_written_handler,
I2C_SMBUS_WRITE, I2C_SMBUS_WRITE,
SSIF_IPMI_MULTI_PART_REQUEST_MIDDLE, SSIF_IPMI_MULTI_PART_REQUEST_MIDDLE,
ssif_info->multi_data + ssif_info->multi_pos, data_to_send,
I2C_SMBUS_BLOCK_DATA); I2C_SMBUS_BLOCK_DATA);
if (rv < 0) { if (rv < 0) {
/* request failed, just return the error. */ /* request failed, just return the error. */
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment