[src/trunk]: src/sys/dev/i2c iic_ioctl_exec: initialize cmd before using it

[jmcneill <jmcneill%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/32f6444778ad
branches:  trunk
changeset: 770078:32f6444778ad
user:      jmcneill <jmcneill%NetBSD.org@localhost>
date:      Sun Oct 02 21:12:43 2011 +0000

description:
iic_ioctl_exec: initialize cmd before using it

diffstat:

 sys/dev/i2c/i2c.c |  17 +++++++++++++----
 1 files changed, 13 insertions(+), 4 deletions(-)

diffs (62 lines):

diff -r 0648d9dcc7d8 -r 32f6444778ad sys/dev/i2c/i2c.c
--- a/sys/dev/i2c/i2c.c Sun Oct 02 21:10:03 2011 +0000
+++ b/sys/dev/i2c/i2c.c Sun Oct 02 21:12:43 2011 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: i2c.c,v 1.33 2011/10/02 18:58:45 jmcneill Exp $        */
+/*     $NetBSD: i2c.c,v 1.34 2011/10/02 21:12:43 jmcneill Exp $        */
 
 /*
  * Copyright (c) 2003 Wasabi Systems, Inc.
@@ -36,7 +36,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: i2c.c,v 1.33 2011/10/02 18:58:45 jmcneill Exp $");
+__KERNEL_RCSID(0, "$NetBSD: i2c.c,v 1.34 2011/10/02 21:12:43 jmcneill Exp $");
 
 #include <sys/param.h>
 #include <sys/systm.h>
@@ -44,6 +44,7 @@
 #include <sys/event.h>
 #include <sys/conf.h>
 #include <sys/malloc.h>
+#include <sys/kmem.h>
 #include <sys/kthread.h>
 #include <sys/proc.h>
 #include <sys/kernel.h>
@@ -479,8 +480,8 @@
 {
        i2c_tag_t ic = sc->sc_tag;
        uint8_t buf[I2C_EXEC_MAX_BUFLEN];
+       void *cmd = NULL;
        int error;
-       void *cmd;
 
        /* Validate parameters */
        if (iie->iie_addr > I2C_MAX_ADDR)
@@ -502,9 +503,14 @@
 #endif
 
        if (iie->iie_cmd != NULL) {
+               cmd = kmem_alloc(iie->iie_cmdlen, KM_SLEEP);
+               if (cmd == NULL)
+                       return ENOMEM;
                error = copyin(iie->iie_cmd, cmd, iie->iie_cmdlen);
-               if (error)
+               if (error) {
+                       kmem_free(cmd, iie->iie_cmdlen);
                        return error;
+               }
        }
 
        iic_acquire_bus(ic, 0);
@@ -512,6 +518,9 @@
            buf, iie->iie_buflen, 0);
        iic_release_bus(ic, 0);
 
+       if (cmd)
+               kmem_free(cmd, iie->iie_cmdlen);
+
        if (error)
                return error;