Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9df7fde5 authored by Eric Sesterhenn's avatar Eric Sesterhenn Committed by Greg Kroah-Hartman
Browse files

[PATCH] PCI Hotplug: fake NULL pointer dereferences in IBM Hot Plug Controller Driver 



Remove checks for value, since the hotplug core always provides
a valid value.

Signed-off-by: default avatarEric Sesterhenn <snakebyte@gmx.de>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
parent 99ff124d

drivers/pci/hotplug/ibmphp_core.c

+6 −6
Original line number Original line Diff line number Diff line
@@ -285,7 +285,7 @@ static int get_attention_status(struct hotplug_slot *hotplug_slot, u8 * value) 
					(ulong) hotplug_slot, (ulong) value);

					(ulong) hotplug_slot, (ulong) value);

        

        

	ibmphp_lock_operations();

	ibmphp_lock_operations();

	if (hotplug_slot && value) {

	if (hotplug_slot) {

		pslot = hotplug_slot->private;

		pslot = hotplug_slot->private;

		if (pslot) {

		if (pslot) {

			memcpy(&myslot, pslot, sizeof(struct slot));

			memcpy(&myslot, pslot, sizeof(struct slot));
@@ -315,7 +315,7 @@ static int get_latch_status(struct hotplug_slot *hotplug_slot, u8 * value) 
	debug("get_latch_status - Entry hotplug_slot[%lx] pvalue[%lx]\n",

	debug("get_latch_status - Entry hotplug_slot[%lx] pvalue[%lx]\n",

					(ulong) hotplug_slot, (ulong) value);

					(ulong) hotplug_slot, (ulong) value);

	ibmphp_lock_operations();

	ibmphp_lock_operations();

	if (hotplug_slot && value) {

	if (hotplug_slot) {

		pslot = hotplug_slot->private;

		pslot = hotplug_slot->private;

		if (pslot) {

		if (pslot) {

			memcpy(&myslot, pslot, sizeof(struct slot));

			memcpy(&myslot, pslot, sizeof(struct slot));
@@ -342,7 +342,7 @@ static int get_power_status(struct hotplug_slot *hotplug_slot, u8 * value) 
	debug("get_power_status - Entry hotplug_slot[%lx] pvalue[%lx]\n",

	debug("get_power_status - Entry hotplug_slot[%lx] pvalue[%lx]\n",

					(ulong) hotplug_slot, (ulong) value);

					(ulong) hotplug_slot, (ulong) value);

	ibmphp_lock_operations();

	ibmphp_lock_operations();

	if (hotplug_slot && value) {

	if (hotplug_slot) {

		pslot = hotplug_slot->private;

		pslot = hotplug_slot->private;

		if (pslot) {

		if (pslot) {

			memcpy(&myslot, pslot, sizeof(struct slot));

			memcpy(&myslot, pslot, sizeof(struct slot));
@@ -369,7 +369,7 @@ static int get_adapter_present(struct hotplug_slot *hotplug_slot, u8 * value) 
	debug("get_adapter_status - Entry hotplug_slot[%lx] pvalue[%lx]\n",

	debug("get_adapter_status - Entry hotplug_slot[%lx] pvalue[%lx]\n",

					(ulong) hotplug_slot, (ulong) value);

					(ulong) hotplug_slot, (ulong) value);

	ibmphp_lock_operations();

	ibmphp_lock_operations();

	if (hotplug_slot && value) {

	if (hotplug_slot) {

		pslot = hotplug_slot->private;

		pslot = hotplug_slot->private;

		if (pslot) {

		if (pslot) {

			memcpy(&myslot, pslot, sizeof(struct slot));

			memcpy(&myslot, pslot, sizeof(struct slot));
@@ -401,7 +401,7 @@ static int get_max_bus_speed(struct hotplug_slot *hotplug_slot, enum pci_bus_spe 




	ibmphp_lock_operations();

	ibmphp_lock_operations();





	if (hotplug_slot && value) {

	if (hotplug_slot) {

		pslot = hotplug_slot->private;

		pslot = hotplug_slot->private;

		if (pslot) {

		if (pslot) {

			rc = 0;

			rc = 0;
@@ -441,7 +441,7 @@ static int get_cur_bus_speed(struct hotplug_slot *hotplug_slot, enum pci_bus_spe 




	ibmphp_lock_operations();

	ibmphp_lock_operations();





	if (hotplug_slot && value) {

	if (hotplug_slot) {

		pslot = hotplug_slot->private;

		pslot = hotplug_slot->private;

		if (pslot) {

		if (pslot) {

			rc = get_cur_bus_info(&pslot);

			rc = get_cur_bus_info(&pslot);