aboutsummaryrefslogtreecommitdiffstats
path: root/drivers
diff options
context:
space:
mode:
authorJeff Garzik <jeff@garzik.org>2006-10-17 03:10:40 -0400
committerLinus Torvalds <torvalds@g5.osdl.org>2006-10-17 11:18:49 -0400
commit7786ce192fc4917fb9b789dd823476ff8fd6cf66 (patch)
tree3ec803c1c77ff22bfe6076ea4d90a27f888b4fad /drivers
parent04518bfe8eac2e82b476fb2b0093527adc2bc791 (diff)
[PATCH] ISDN: check for userspace copy faults
Most of the ISDN ->readstat() implementations needed to check copy_to_user() and put_user() return values. Signed-off-by: Jeff Garzik <jeff@garzik.org> Cc: Karsten Keil <kkeil@suse.de> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Diffstat (limited to 'drivers')
-rw-r--r--drivers/isdn/capi/capidrv.c3
-rw-r--r--drivers/isdn/hisax/config.c6
-rw-r--r--drivers/isdn/icn/icn.c3
-rw-r--r--drivers/isdn/isdnloop/isdnloop.c3
-rw-r--r--drivers/isdn/pcbit/drv.c16
5 files changed, 20 insertions, 11 deletions
diff --git a/drivers/isdn/capi/capidrv.c b/drivers/isdn/capi/capidrv.c
index d10c8b82e6aa..b6f9476c0501 100644
--- a/drivers/isdn/capi/capidrv.c
+++ b/drivers/isdn/capi/capidrv.c
@@ -1907,7 +1907,8 @@ static int if_readstat(u8 __user *buf, int len, int id, int channel)
1907 } 1907 }
1908 1908
1909 for (p=buf, count=0; count < len; p++, count++) { 1909 for (p=buf, count=0; count < len; p++, count++) {
1910 put_user(*card->q931_read++, p); 1910 if (put_user(*card->q931_read++, p))
1911 return -EFAULT;
1911 if (card->q931_read > card->q931_end) 1912 if (card->q931_read > card->q931_end)
1912 card->q931_read = card->q931_buf; 1913 card->q931_read = card->q931_buf;
1913 } 1914 }
diff --git a/drivers/isdn/hisax/config.c b/drivers/isdn/hisax/config.c
index e4823ab2b127..785b08554fca 100644
--- a/drivers/isdn/hisax/config.c
+++ b/drivers/isdn/hisax/config.c
@@ -631,7 +631,8 @@ static int HiSax_readstatus(u_char __user *buf, int len, int id, int channel)
631 count = cs->status_end - cs->status_read + 1; 631 count = cs->status_end - cs->status_read + 1;
632 if (count >= len) 632 if (count >= len)
633 count = len; 633 count = len;
634 copy_to_user(p, cs->status_read, count); 634 if (copy_to_user(p, cs->status_read, count))
635 return -EFAULT;
635 cs->status_read += count; 636 cs->status_read += count;
636 if (cs->status_read > cs->status_end) 637 if (cs->status_read > cs->status_end)
637 cs->status_read = cs->status_buf; 638 cs->status_read = cs->status_buf;
@@ -642,7 +643,8 @@ static int HiSax_readstatus(u_char __user *buf, int len, int id, int channel)
642 cnt = HISAX_STATUS_BUFSIZE; 643 cnt = HISAX_STATUS_BUFSIZE;
643 else 644 else
644 cnt = count; 645 cnt = count;
645 copy_to_user(p, cs->status_read, cnt); 646 if (copy_to_user(p, cs->status_read, cnt))
647 return -EFAULT;
646 p += cnt; 648 p += cnt;
647 cs->status_read += cnt % HISAX_STATUS_BUFSIZE; 649 cs->status_read += cnt % HISAX_STATUS_BUFSIZE;
648 count -= cnt; 650 count -= cnt;
diff --git a/drivers/isdn/icn/icn.c b/drivers/isdn/icn/icn.c
index 6649f8bc9951..730bbd07ebc7 100644
--- a/drivers/isdn/icn/icn.c
+++ b/drivers/isdn/icn/icn.c
@@ -1010,7 +1010,8 @@ icn_readstatus(u_char __user *buf, int len, icn_card * card)
1010 for (p = buf, count = 0; count < len; p++, count++) { 1010 for (p = buf, count = 0; count < len; p++, count++) {
1011 if (card->msg_buf_read == card->msg_buf_write) 1011 if (card->msg_buf_read == card->msg_buf_write)
1012 return count; 1012 return count;
1013 put_user(*card->msg_buf_read++, p); 1013 if (put_user(*card->msg_buf_read++, p))
1014 return -EFAULT;
1014 if (card->msg_buf_read > card->msg_buf_end) 1015 if (card->msg_buf_read > card->msg_buf_end)
1015 card->msg_buf_read = card->msg_buf; 1016 card->msg_buf_read = card->msg_buf;
1016 } 1017 }
diff --git a/drivers/isdn/isdnloop/isdnloop.c b/drivers/isdn/isdnloop/isdnloop.c
index 23afba46433e..c3ae2edaf6fa 100644
--- a/drivers/isdn/isdnloop/isdnloop.c
+++ b/drivers/isdn/isdnloop/isdnloop.c
@@ -446,7 +446,8 @@ isdnloop_readstatus(u_char __user *buf, int len, isdnloop_card * card)
446 for (p = buf, count = 0; count < len; p++, count++) { 446 for (p = buf, count = 0; count < len; p++, count++) {
447 if (card->msg_buf_read == card->msg_buf_write) 447 if (card->msg_buf_read == card->msg_buf_write)
448 return count; 448 return count;
449 put_user(*card->msg_buf_read++, p); 449 if (put_user(*card->msg_buf_read++, p))
450 return -EFAULT;
450 if (card->msg_buf_read > card->msg_buf_end) 451 if (card->msg_buf_read > card->msg_buf_end)
451 card->msg_buf_read = card->msg_buf; 452 card->msg_buf_read = card->msg_buf;
452 } 453 }
diff --git a/drivers/isdn/pcbit/drv.c b/drivers/isdn/pcbit/drv.c
index 94f21486bb24..6ead5e1508b7 100644
--- a/drivers/isdn/pcbit/drv.c
+++ b/drivers/isdn/pcbit/drv.c
@@ -725,23 +725,27 @@ static int pcbit_stat(u_char __user *buf, int len, int driver, int channel)
725 725
726 if (stat_st < stat_end) 726 if (stat_st < stat_end)
727 { 727 {
728 copy_to_user(buf, statbuf + stat_st, len); 728 if (copy_to_user(buf, statbuf + stat_st, len))
729 return -EFAULT;
729 stat_st += len; 730 stat_st += len;
730 } 731 }
731 else 732 else
732 { 733 {
733 if (len > STATBUF_LEN - stat_st) 734 if (len > STATBUF_LEN - stat_st)
734 { 735 {
735 copy_to_user(buf, statbuf + stat_st, 736 if (copy_to_user(buf, statbuf + stat_st,
736 STATBUF_LEN - stat_st); 737 STATBUF_LEN - stat_st))
737 copy_to_user(buf, statbuf, 738 return -EFAULT;
738 len - (STATBUF_LEN - stat_st)); 739 if (copy_to_user(buf, statbuf,
740 len - (STATBUF_LEN - stat_st)))
741 return -EFAULT;
739 742
740 stat_st = len - (STATBUF_LEN - stat_st); 743 stat_st = len - (STATBUF_LEN - stat_st);
741 } 744 }
742 else 745 else
743 { 746 {
744 copy_to_user(buf, statbuf + stat_st, len); 747 if (copy_to_user(buf, statbuf + stat_st, len))
748 return -EFAULT;
745 749
746 stat_st += len; 750 stat_st += len;
747 751