alpha: Prevent a NULL ptr dereference in csum_partial_copy.

Jay Estabrook · mattst88 · commit 5cfe8f1ba5ee · 2013-11-16T16:48:42.000-08:00
Introduced by 3ddc5b4 ("kernel-wide: fix missing validations on __get/__put/__copy_to/__copy_from_user()"). Also fix some other places which could be problematic in a similar way, although they hadn't been proved so, as far as I can tell. Cc: Michael Cree <mcree@orcon.net.nz> Signed-off-by: Matt Turner <mattst88@gmail.com>
diff --git a/arch/alpha/lib/csum_partial_copy.c b/arch/alpha/lib/csum_partial_copy.c
@@ -130,7 +130,7 @@ csum_partial_cfu_aligned(const unsigned long __user *src, unsigned long *dst,
 		*dst = word | tmp;
 		checksum += carry;
 	}
-	if (err) *errp = err;
+	if (err && errp) *errp = err;
 	return checksum;
 }
 
@@ -185,7 +185,7 @@ csum_partial_cfu_dest_aligned(const unsigned long __user *src,
 		*dst = word | tmp;
 		checksum += carry;
 	}
-	if (err) *errp = err;
+	if (err && errp) *errp = err;
 	return checksum;
 }
 
@@ -242,7 +242,7 @@ csum_partial_cfu_src_aligned(const unsigned long __user *src,
 	stq_u(partial_dest | second_dest, dst);
 out:
 	checksum += carry;
-	if (err) *errp = err;
+	if (err && errp) *errp = err;
 	return checksum;
 }
 
@@ -325,7 +325,7 @@ csum_partial_cfu_unaligned(const unsigned long __user * src,
 		stq_u(partial_dest | word | second_dest, dst);
 		checksum += carry;
 	}
-	if (err) *errp = err;
+	if (err && errp) *errp = err;
 	return checksum;
 }
 
@@ -339,7 +339,7 @@ csum_partial_copy_from_user(const void __user *src, void *dst, int len,
 
 	if (len) {
 		if (!access_ok(VERIFY_READ, src, len)) {
-			*errp = -EFAULT;
+			if (errp) *errp = -EFAULT;
 			memset(dst, 0, len);
 			return sum;
 		}

Original file line number	Diff line number	Diff line change
`@@ -130,7 +130,7 @@ csum_partial_cfu_aligned(const unsigned long __user src, unsigned long dst,`
`130`	`130`	`*dst = word \| tmp;`
`131`	`131`	`checksum += carry;`
`132`	`132`	`}`
`133`		`- if (err) *errp = err;`
	`133`	`+ if (err && errp) *errp = err;`
`134`	`134`	`return checksum;`
`135`	`135`	`}`
`136`	`136`
`@@ -185,7 +185,7 @@ csum_partial_cfu_dest_aligned(const unsigned long __user *src,`
`185`	`185`	`*dst = word \| tmp;`
`186`	`186`	`checksum += carry;`
`187`	`187`	`}`
`188`		`- if (err) *errp = err;`
	`188`	`+ if (err && errp) *errp = err;`
`189`	`189`	`return checksum;`
`190`	`190`	`}`
`191`	`191`
`@@ -242,7 +242,7 @@ csum_partial_cfu_src_aligned(const unsigned long __user *src,`
`242`	`242`	`stq_u(partial_dest \| second_dest, dst);`
`243`	`243`	`out:`
`244`	`244`	`checksum += carry;`
`245`		`- if (err) *errp = err;`
	`245`	`+ if (err && errp) *errp = err;`
`246`	`246`	`return checksum;`
`247`	`247`	`}`
`248`	`248`
`@@ -325,7 +325,7 @@ csum_partial_cfu_unaligned(const unsigned long __user * src,`
`325`	`325`	`stq_u(partial_dest \| word \| second_dest, dst);`
`326`	`326`	`checksum += carry;`
`327`	`327`	`}`
`328`		`- if (err) *errp = err;`
	`328`	`+ if (err && errp) *errp = err;`
`329`	`329`	`return checksum;`
`330`	`330`	`}`
`331`	`331`
`@@ -339,7 +339,7 @@ csum_partial_copy_from_user(const void __user src, void dst, int len,`
`339`	`339`
`340`	`340`	`if (len) {`
`341`	`341`	`if (!access_ok(VERIFY_READ, src, len)) {`
`342`		`- *errp = -EFAULT;`
	`342`	`+ if (errp) *errp = -EFAULT;`
`343`	`343`	`memset(dst, 0, len);`
`344`	`344`	`return sum;`
`345`	`345`	`}`