Print this page
11839 ipmi_close can panic trying to free invalid dev_t
Reviewed by: Andy Stormont <astormont@racktopsystems.com>
Reviewed by: Garrett D'Amore <garrett@damore.org>

Split Close
Expand all
Collapse all
          --- old/usr/src/uts/intel/io/ipmi/ipmi_main.c
          +++ new/usr/src/uts/intel/io/ipmi/ipmi_main.c
↓ open down ↓ 154 lines elided ↑ open up ↑
 155  155          if (ipmi_attached == B_FALSE)
 156  156                  return (ENXIO);
 157  157  
 158  158          if (ipmi_found == B_FALSE)
 159  159                  return (ENODEV);
 160  160  
 161  161          /* exclusive opens are not supported */
 162  162          if (flag & FEXCL)
 163  163                  return (ENOTSUP);
 164  164  
 165      -        if ((minor = (minor_t)id_alloc_nosleep(minor_ids)) == 0)
      165 +        if ((minor = (minor_t)id_alloc_nosleep(minor_ids)) == (minor_t)(-1))
 166  166                  return (ENODEV);
 167  167  
 168  168          /* Initialize the per file descriptor data. */
 169  169          dev = kmem_zalloc(sizeof (ipmi_device_t), KM_SLEEP);
 170  170  
 171  171          dev->ipmi_pollhead = kmem_zalloc(sizeof (pollhead_t), KM_SLEEP);
 172  172  
 173  173          TAILQ_INIT(&dev->ipmi_completed_requests);
 174  174          dev->ipmi_address = IPMI_BMC_SLAVE_ADDR;
 175  175          dev->ipmi_lun = IPMI_BMC_SMS_LUN;
↓ open down ↓ 469 lines elided ↑ open up ↑
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX