aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/atm/he.c
diff options
context:
space:
mode:
authorRobert T. Johnson <rtjohnso@eecs.berkeley.edu>2008-06-16 20:20:52 -0400
committerDavid S. Miller <davem@davemloft.net>2008-06-16 20:20:52 -0400
commit28e84ab3abafb0f9c9573993626abe6ca3fa8eb1 (patch)
tree13d7c12e8041d9e0f64c37d6764c492857ab230b /drivers/atm/he.c
parent7e903c2ae36efb526eacab3b25d00e90424bd8a8 (diff)
atm: [he] limit queries to the device's register space
From: "Robert T. Johnson" <rtjohnso@eecs.berkeley.edu> Signed-off-by: Chas Williams <chas@cmf.nrl.navy.mil>
Diffstat (limited to 'drivers/atm/he.c')
-rw-r--r--drivers/atm/he.c7
1 files changed, 6 insertions, 1 deletions
diff --git a/drivers/atm/he.c b/drivers/atm/he.c
index 320320e3dfb3..fc636a3429cf 100644
--- a/drivers/atm/he.c
+++ b/drivers/atm/he.c
@@ -2845,10 +2845,15 @@ he_ioctl(struct atm_dev *atm_dev, unsigned int cmd, void __user *arg)
2845 if (copy_from_user(&reg, arg, 2845 if (copy_from_user(&reg, arg,
2846 sizeof(struct he_ioctl_reg))) 2846 sizeof(struct he_ioctl_reg)))
2847 return -EFAULT; 2847 return -EFAULT;
2848 2848
2849 spin_lock_irqsave(&he_dev->global_lock, flags); 2849 spin_lock_irqsave(&he_dev->global_lock, flags);
2850 switch (reg.type) { 2850 switch (reg.type) {
2851 case HE_REGTYPE_PCI: 2851 case HE_REGTYPE_PCI:
2852 if (reg.addr < 0 || reg.addr >= HE_REGMAP_SIZE) {
2853 err = -EINVAL;
2854 break;
2855 }
2856
2852 reg.val = he_readl(he_dev, reg.addr); 2857 reg.val = he_readl(he_dev, reg.addr);
2853 break; 2858 break;
2854 case HE_REGTYPE_RCM: 2859 case HE_REGTYPE_RCM: