Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6de65fcf authored by Joeseph Chang's avatar Joeseph Chang Committed by Corey Minyard
Browse files

ipmi: Fix kernel panic at ipmi_ssif_thread() 



msg_written_handler() may set ssif_info->multi_data to NULL
when using ipmitool to write fru.

Before setting ssif_info->multi_data to NULL, add new local
pointer "data_to_send" and store correct i2c data pointer to
it to fix NULL pointer kernel panic and incorrect ssif_info->multi_pos.

Signed-off-by: default avatarJoeseph Chang <joechang@codeaurora.org>
Signed-off-by: default avatarCorey Minyard <cminyard@mvista.com>
Cc: stable@vger.kernel.org # 3.19-
parent ea6200e8

drivers/char/ipmi/ipmi_ssif.c

+3 −1
Original line number Diff line number Diff line
@@ -891,6 +891,7 @@ static void msg_written_handler(struct ssif_info *ssif_info, int result, 
		 * for details on the intricacies of this.

		 */

		int left;

		unsigned char *data_to_send;



		ssif_inc_stat(ssif_info, sent_messages_parts);
@@ -899,6 +900,7 @@ static void msg_written_handler(struct ssif_info *ssif_info, int result, 
			left = 32;

		/* Length byte. */

		ssif_info->multi_data[ssif_info->multi_pos] = left;

		data_to_send = ssif_info->multi_data + ssif_info->multi_pos;

		ssif_info->multi_pos += left;

		if (left < 32)

			/*
@@ -912,7 +914,7 @@ static void msg_written_handler(struct ssif_info *ssif_info, int result, 
		rv = ssif_i2c_send(ssif_info, msg_written_handler,

				  I2C_SMBUS_WRITE,

				  SSIF_IPMI_MULTI_PART_REQUEST_MIDDLE,

				  ssif_info->multi_data + ssif_info->multi_pos,

				  data_to_send,

				  I2C_SMBUS_BLOCK_DATA);

		if (rv < 0) {

			/* request failed, just return the error. */