On Fri, Jan 29, 2016 at 02:52:26PM +0200, Imre Deak wrote: > While we are calling intel_dp_aux_transfer() with msg->size=0 whenever > msg->buffer is NULL, passing NULL to memcpy() is undefined according to > the ISO C standard. I haven't found any notes about this in the GNU C's > or the kernel's documentation of the function and can't imagine what it > would do with the NULL ptr. To better document this use of the > parameters it still make sense to add an explicit check for this to the > code. > > Caught by Coverity. > > Signed-off-by: Imre Deak <[email protected]>
Reviewed-by: David Weinehall <[email protected]> > --- > drivers/gpu/drm/i915/intel_dp.c | 5 ++++- > 1 file changed, 4 insertions(+), 1 deletion(-) > > diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c > index e2bea710..2aed36e 100644 > --- a/drivers/gpu/drm/i915/intel_dp.c > +++ b/drivers/gpu/drm/i915/intel_dp.c > @@ -979,7 +979,10 @@ intel_dp_aux_transfer(struct drm_dp_aux *aux, struct > drm_dp_aux_msg *msg) > if (WARN_ON(txsize > 20)) > return -E2BIG; > > - memcpy(txbuf + HEADER_SIZE, msg->buffer, msg->size); > + if (msg->buffer) > + memcpy(txbuf + HEADER_SIZE, msg->buffer, msg->size); > + else > + WARN_ON(msg->size); > > ret = intel_dp_aux_ch(intel_dp, txbuf, txsize, rxbuf, rxsize); > if (ret > 0) { > -- > 2.5.0 > _______________________________________________ Intel-gfx mailing list [email protected] http://lists.freedesktop.org/mailman/listinfo/intel-gfx
