Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a7be18d4 authored by Alan Cox's avatar Alan Cox Committed by Linus Torvalds
Browse files

applicom: Fix an unchecked user ioctl range and an error return 



Closes bug #11408 by checking the card index range for command 0
Fixes the ioctl to return ENOTTY which is correct for unknown ioctls

Signed-off-by: default avatarAlan Cox <alan@redhat.com>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 17b82060

drivers/char/applicom.c

+2 −4
Original line number Diff line number Diff line
@@ -712,8 +712,7 @@ static int ac_ioctl(struct inode *inode, struct file *file, unsigned int cmd, un 
	

	IndexCard = adgl->num_card-1;

	 

	if(cmd != 0 && cmd != 6 &&

	   ((IndexCard >= MAX_BOARD) || !apbs[IndexCard].RamIO)) {

	if(cmd != 6 && ((IndexCard >= MAX_BOARD) || !apbs[IndexCard].RamIO)) {

		static int warncount = 10;

		if (warncount) {

			printk( KERN_WARNING "APPLICOM driver IOCTL, bad board number %d\n",(int)IndexCard+1);
@@ -832,8 +831,7 @@ static int ac_ioctl(struct inode *inode, struct file *file, unsigned int cmd, un 
		}

		break;

	default:

		printk(KERN_INFO "APPLICOM driver ioctl, unknown function code %d\n",cmd) ;

		ret = -EINVAL;

		ret = -ENOTTY;

		break;

	}

	Dummy = readb(apbs[IndexCard].RamIO + VERS);