diff options
| author | sam <sam@FreeBSD.org> | 2005-03-31 05:15:27 +0000 |
|---|---|---|
| committer | sam <sam@FreeBSD.org> | 2005-03-31 05:15:27 +0000 |
| commit | 0f37f556b7b917470b04f16a84165624c63eca58 (patch) | |
| tree | 71be040c1d3547f058978c8a252499f4c018feb2 /sys/dev/hptmv | |
| parent | 049c04b5b180f7abf2580aef7da149e8d7c85e3a (diff) | |
| download | FreeBSD-src-0f37f556b7b917470b04f16a84165624c63eca58.zip FreeBSD-src-0f37f556b7b917470b04f16a84165624c63eca58.tar.gz | |
check copyin return value (and while we're at it copyout too)
Noticed by: Coverity Prevent analysis tool
Diffstat (limited to 'sys/dev/hptmv')
| -rw-r--r-- | sys/dev/hptmv/hptproc.c | 22 |
1 files changed, 14 insertions, 8 deletions
diff --git a/sys/dev/hptmv/hptproc.c b/sys/dev/hptmv/hptproc.c index 1c4fb90..997183f 100644 --- a/sys/dev/hptmv/hptproc.c +++ b/sys/dev/hptmv/hptproc.c @@ -293,22 +293,28 @@ static int hpt_set_info(int length) return -EINVAL; } + err = 0; if (piop->nInBufferSize) - copyin((void*)(ULONG_PTR)piop->lpInBuffer, ke_area, piop->nInBufferSize); + err = copyin((void*)(ULONG_PTR)piop->lpInBuffer, ke_area, piop->nInBufferSize); /* * call kernel handler. */ - err = Kernel_DeviceIoControl(&gIal_Adapter->VBus, - piop->dwIoControlCode, ke_area, piop->nInBufferSize, - ke_area + piop->nInBufferSize, piop->nOutBufferSize, &dwRet); + if (err==0) + err = Kernel_DeviceIoControl(&gIal_Adapter->VBus, + piop->dwIoControlCode, ke_area, piop->nInBufferSize, + ke_area + piop->nInBufferSize, piop->nOutBufferSize, &dwRet); if (err==0) { - if (piop->nOutBufferSize) - copyout(ke_area + piop->nInBufferSize, (void*)(ULONG_PTR)piop->lpOutBuffer, piop->nOutBufferSize); + if (piop->nOutBufferSize) { + err = copyout(ke_area + piop->nInBufferSize, (void*)(ULONG_PTR)piop->lpOutBuffer, piop->nOutBufferSize); + if (err) KdPrintW(("Kernel_ioctl(): copyout (1) return %d\n", err)); + } - if (piop->lpBytesReturned) - copyout(&dwRet, (void*)(ULONG_PTR)piop->lpBytesReturned, sizeof(DWORD)); + if (piop->lpBytesReturned) { + err = copyout(&dwRet, (void*)(ULONG_PTR)piop->lpBytesReturned, sizeof(DWORD)); + if (err) KdPrintW(("Kernel_ioctl(): copyout (2) return %d\n", err)); + } free(ke_area, M_DEVBUF); return length; |
