diff options
author | Alexandr Andreev <aandreev@openvz.org> | 2007-03-06 05:34:24 -0500 |
---|---|---|
committer | Tony Luck <tony.luck@intel.com> | 2007-03-06 17:49:24 -0500 |
commit | 50157b09b33c2ec3637d3b317b06a7235c57c7f2 (patch) | |
tree | 83d66f438c0d7bb67a00aff9f3b5359556f72a36 /arch/ia64/ia32/sys_ia32.c | |
parent | a27e5a13d5863bb9de0ac80cb4bb3f4442f0aad1 (diff) |
[IA64] sync compat getdents
Add VERIFY_WRITE check in the beginning like compat_sys_getdents() (EINVAL vs
EFAULT).
Signed-off-by: Alexandr Andreev <aandreev@openvz.org>
Signed-off-by: Alexey Dobriyan <adobriyan@openvz.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Tony Luck <tony.luck@intel.com>
Diffstat (limited to 'arch/ia64/ia32/sys_ia32.c')
-rw-r--r-- | arch/ia64/ia32/sys_ia32.c | 10 |
1 files changed, 7 insertions, 3 deletions
diff --git a/arch/ia64/ia32/sys_ia32.c b/arch/ia64/ia32/sys_ia32.c index d430d36ae49..0afb4fe7c35 100644 --- a/arch/ia64/ia32/sys_ia32.c +++ b/arch/ia64/ia32/sys_ia32.c | |||
@@ -1267,6 +1267,10 @@ sys32_getdents (unsigned int fd, struct compat_dirent __user *dirent, unsigned i | |||
1267 | struct getdents32_callback buf; | 1267 | struct getdents32_callback buf; |
1268 | int error; | 1268 | int error; |
1269 | 1269 | ||
1270 | error = -EFAULT; | ||
1271 | if (!access_ok(VERIFY_WRITE, dirent, count)) | ||
1272 | goto out; | ||
1273 | |||
1270 | error = -EBADF; | 1274 | error = -EBADF; |
1271 | file = fget(fd); | 1275 | file = fget(fd); |
1272 | if (!file) | 1276 | if (!file) |
@@ -1283,10 +1287,10 @@ sys32_getdents (unsigned int fd, struct compat_dirent __user *dirent, unsigned i | |||
1283 | error = buf.error; | 1287 | error = buf.error; |
1284 | lastdirent = buf.previous; | 1288 | lastdirent = buf.previous; |
1285 | if (lastdirent) { | 1289 | if (lastdirent) { |
1286 | error = -EINVAL; | ||
1287 | if (put_user(file->f_pos, &lastdirent->d_off)) | 1290 | if (put_user(file->f_pos, &lastdirent->d_off)) |
1288 | goto out_putf; | 1291 | error = -EFAULT; |
1289 | error = count - buf.count; | 1292 | else |
1293 | error = count - buf.count; | ||
1290 | } | 1294 | } |
1291 | 1295 | ||
1292 | out_putf: | 1296 | out_putf: |