| Message ID | 20210731074410.71376-1-islituo@gmail.com (mailing list archive) |
|---|---|
| State | Deferred |
| Headers | show |
| Series | megaraid: fix possible uninitialized-variable access in megadev_ioctl() | expand |
diff --git a/drivers/scsi/megaraid.c b/drivers/scsi/megaraid.c index 56910e94dbf2..8b0676b862fb 100644 --- a/drivers/scsi/megaraid.c +++ b/drivers/scsi/megaraid.c @@ -2975,7 +2975,7 @@ megadev_ioctl(struct file *filep, unsigned int cmd, unsigned long arg) mega_passthru *pthru; /* copy user passthru here */ dma_addr_t pthru_dma_hndl; void *data = NULL; /* data to be transferred */ - dma_addr_t data_dma_hndl; /* dma handle for data xfer area */ + dma_addr_t data_dma_hndl = 0; /* dma handle for data xfer area */ megacmd_t mc; #if MEGA_HAVE_STATS megastat_t __user *ustats = NULL;
The variable pthru_dma_hndl is not initialized at the beginning of the function megadev_ioctl(). It remains uninitialized if the variable uioc.xferlen is zero at line 3275. However, it is accessed at line 3311: mc.xferaddr = (u32)data_dma_hndl; To fix this possible bug, pthru_dma_hndl is initialized to zero at the beginning of the function megadev_ioctl(). Reported-by: TOTE Robot <oslab@tsinghua.edu.cn> Signed-off-by: Tuo Li <islituo@gmail.com> --- drivers/scsi/megaraid.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)