Hi, I noticed a case in sr_ioctl.c's sr_get_mcn where a buffer is allocated, but the pointer isn't checked for null. This patch against 2.6.12-rc2 adds a check. Nate Dailey Stratus Technologies Signed-off-by: Nate Dailey <nate.dailey@xxxxxxxxxxx> --- linux-2.6.12-rc2/drivers/scsi/sr_ioctl.c.orig 2005-04-20 11:31:27.000000000 -0400 +++ linux-2.6.12-rc2/drivers/scsi/sr_ioctl.c 2005-04-20 11:33:58.000000000 -0400 @@ -281,6 +281,9 @@ int sr_get_mcn(struct cdrom_device_info char *buffer = kmalloc(32, GFP_KERNEL | SR_GFP_DMA(cd)); int result; + if (!buffer) + return -ENOMEM; + memset(&cgc, 0, sizeof(struct packet_command)); cgc.cmd[0] = GPCMD_READ_SUBCHANNEL; cgc.cmd[2] = 0x40; /* I do want the subchannel info */ - : send the line "unsubscribe linux-scsi" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
