Skip to content

Commit bf476fe

Browse files
Sergey ShtylyovDamien Le Moal
authored andcommitted
ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo()
In an unlikely (and probably wrong?) case that the 'ppi' parameter of ata_host_alloc_pinfo() points to an array starting with a NULL pointer, there's going to be a kernel oops as the 'pi' local variable won't get reassigned from the initial value of NULL. Initialize 'pi' instead to '&ata_dummy_port_info' to fix the possible kernel oops for good... Found by Linux Verification Center (linuxtesting.org) with the SVACE static analysis tool. Signed-off-by: Sergey Shtylyov <s.shtylyov@omp.ru> Signed-off-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
1 parent a734510 commit bf476fe

1 file changed

Lines changed: 2 additions & 2 deletions

File tree

drivers/ata/libata-core.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5462,15 +5462,15 @@ struct ata_host *ata_host_alloc_pinfo(struct device *dev,
54625462
const struct ata_port_info * const * ppi,
54635463
int n_ports)
54645464
{
5465-
const struct ata_port_info *pi;
5465+
const struct ata_port_info *pi = &ata_dummy_port_info;
54665466
struct ata_host *host;
54675467
int i, j;
54685468

54695469
host = ata_host_alloc(dev, n_ports);
54705470
if (!host)
54715471
return NULL;
54725472

5473-
for (i = 0, j = 0, pi = NULL; i < host->n_ports; i++) {
5473+
for (i = 0, j = 0; i < host->n_ports; i++) {
54745474
struct ata_port *ap = host->ports[i];
54755475

54765476
if (ppi[j])

0 commit comments

Comments
 (0)