d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

check copyin return value (and while we're at it copyout too)

Browse Source 
Noticed by:	Coverity Prevent analysis tool
This commit is contained in:
sam 2005-03-31 05:15:27 +00:00
parent f7a5a1f1cf
commit e2b6ccba44
1 changed files with 14 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
sys/dev/hptmv/hptproc.c
View File

@ -293,22 +293,28 @@ static int hpt_set_info(int length)
return -EINVAL;
}
err = 0;
if (piop->nInBufferSize)
copyin((void*)(ULONG_PTR)piop->lpInBuffer, ke_area, piop->nInBufferSize);
err = copyin((void*)(ULONG_PTR)piop->lpInBuffer, ke_area, piop->nInBufferSize);
/*
* call kernel handler.
*/
err = Kernel_DeviceIoControl(&gIal_Adapter->VBus,
piop->dwIoControlCode, ke_area, piop->nInBufferSize,
ke_area + piop->nInBufferSize, piop->nOutBufferSize, &dwRet);
if (err==0)
err = Kernel_DeviceIoControl(&gIal_Adapter->VBus,
piop->dwIoControlCode, ke_area, piop->nInBufferSize,
ke_area + piop->nInBufferSize, piop->nOutBufferSize, &dwRet);
if (err==0) {
if (piop->nOutBufferSize)
copyout(ke_area + piop->nInBufferSize, (void*)(ULONG_PTR)piop->lpOutBuffer, piop->nOutBufferSize);
if (piop->nOutBufferSize) {
err = copyout(ke_area + piop->nInBufferSize, (void*)(ULONG_PTR)piop->lpOutBuffer, piop->nOutBufferSize);
if (err) KdPrintW(("Kernel_ioctl(): copyout (1) return %d\n", err));
}
if (piop->lpBytesReturned)
copyout(&dwRet, (void*)(ULONG_PTR)piop->lpBytesReturned, sizeof(DWORD));
if (piop->lpBytesReturned) {
err = copyout(&dwRet, (void*)(ULONG_PTR)piop->lpBytesReturned, sizeof(DWORD));
if (err) KdPrintW(("Kernel_ioctl(): copyout (2) return %d\n", err));
}
free(ke_area, M_DEVBUF);
return length;