aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/char/applicom.c
diff options
context:
space:
mode:
authorAlan Cox <alan@redhat.com>2008-10-13 05:45:17 -0400
committerLinus Torvalds <torvalds@linux-foundation.org>2008-10-13 12:51:44 -0400
commita7be18d436f0c7007794965e5af29fa1ffff1e05 (patch)
tree4675ce7e3a5255108bf1d9c7f4ec4507592d50b7 /drivers/char/applicom.c
parent17b820606e7bdd3be31b001265d0177423fea5eb (diff)
applicom: Fix an unchecked user ioctl range and an error return
Closes bug #11408 by checking the card index range for command 0 Fixes the ioctl to return ENOTTY which is correct for unknown ioctls Signed-off-by: Alan Cox <alan@redhat.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'drivers/char/applicom.c')
-rw-r--r--drivers/char/applicom.c6
1 files changed, 2 insertions, 4 deletions
diff --git a/drivers/char/applicom.c b/drivers/char/applicom.c
index 31d08b641f5b..b899d9182c7d 100644
--- a/drivers/char/applicom.c
+++ b/drivers/char/applicom.c
@@ -712,8 +712,7 @@ static int ac_ioctl(struct inode *inode, struct file *file, unsigned int cmd, un
712 712
713 IndexCard = adgl->num_card-1; 713 IndexCard = adgl->num_card-1;
714 714
715 if(cmd != 0 && cmd != 6 && 715 if(cmd != 6 && ((IndexCard >= MAX_BOARD) || !apbs[IndexCard].RamIO)) {
716 ((IndexCard >= MAX_BOARD) || !apbs[IndexCard].RamIO)) {
717 static int warncount = 10; 716 static int warncount = 10;
718 if (warncount) { 717 if (warncount) {
719 printk( KERN_WARNING "APPLICOM driver IOCTL, bad board number %d\n",(int)IndexCard+1); 718 printk( KERN_WARNING "APPLICOM driver IOCTL, bad board number %d\n",(int)IndexCard+1);
@@ -832,8 +831,7 @@ static int ac_ioctl(struct inode *inode, struct file *file, unsigned int cmd, un
832 } 831 }
833 break; 832 break;
834 default: 833 default:
835 printk(KERN_INFO "APPLICOM driver ioctl, unknown function code %d\n",cmd) ; 834 ret = -ENOTTY;
836 ret = -EINVAL;
837 break; 835 break;
838 } 836 }
839 Dummy = readb(apbs[IndexCard].RamIO + VERS); 837 Dummy = readb(apbs[IndexCard].RamIO + VERS);