Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7786ce19 authored by Jeff Garzik's avatar Jeff Garzik Committed by Linus Torvalds
Browse files

[PATCH] ISDN: check for userspace copy faults 



Most of the ISDN ->readstat() implementations needed to check
copy_to_user() and put_user() return values.

Signed-off-by: default avatarJeff Garzik <jeff@garzik.org>
Cc: Karsten Keil <kkeil@suse.de>
Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
parent 04518bfe

drivers/isdn/capi/capidrv.c

+2 −1
Original line number Diff line number Diff line
@@ -1907,7 +1907,8 @@ static int if_readstat(u8 __user *buf, int len, int id, int channel) 
	}



	for (p=buf, count=0; count < len; p++, count++) {

		put_user(*card->q931_read++, p);

		if (put_user(*card->q931_read++, p))

			return -EFAULT;

	        if (card->q931_read > card->q931_end)

	                card->q931_read = card->q931_buf;

	}

drivers/isdn/hisax/config.c

+4 −2
Original line number Diff line number Diff line
@@ -631,7 +631,8 @@ static int HiSax_readstatus(u_char __user *buf, int len, int id, int channel) 
		count = cs->status_end - cs->status_read + 1;

		if (count >= len)

			count = len;

		copy_to_user(p, cs->status_read, count);

		if (copy_to_user(p, cs->status_read, count))

			return -EFAULT;

		cs->status_read += count;

		if (cs->status_read > cs->status_end)

			cs->status_read = cs->status_buf;
@@ -642,7 +643,8 @@ static int HiSax_readstatus(u_char __user *buf, int len, int id, int channel) 
				cnt = HISAX_STATUS_BUFSIZE;

			else

				cnt = count;

			copy_to_user(p, cs->status_read, cnt);

			if (copy_to_user(p, cs->status_read, cnt))

				return -EFAULT;

			p += cnt;

			cs->status_read += cnt % HISAX_STATUS_BUFSIZE;

			count -= cnt;

drivers/isdn/icn/icn.c

+2 −1
Original line number Diff line number Diff line
@@ -1010,7 +1010,8 @@ icn_readstatus(u_char __user *buf, int len, icn_card * card) 
	for (p = buf, count = 0; count < len; p++, count++) {

		if (card->msg_buf_read == card->msg_buf_write)

			return count;

		put_user(*card->msg_buf_read++, p);

		if (put_user(*card->msg_buf_read++, p))

			return -EFAULT;

		if (card->msg_buf_read > card->msg_buf_end)

			card->msg_buf_read = card->msg_buf;

	}

drivers/isdn/isdnloop/isdnloop.c

+2 −1
Original line number Diff line number Diff line
@@ -446,7 +446,8 @@ isdnloop_readstatus(u_char __user *buf, int len, isdnloop_card * card) 
	for (p = buf, count = 0; count < len; p++, count++) {

		if (card->msg_buf_read == card->msg_buf_write)

			return count;

		put_user(*card->msg_buf_read++, p);

		if (put_user(*card->msg_buf_read++, p))

			return -EFAULT;

		if (card->msg_buf_read > card->msg_buf_end)

			card->msg_buf_read = card->msg_buf;

	}

drivers/isdn/pcbit/drv.c

+10 −6
Original line number Diff line number Diff line
@@ -725,23 +725,27 @@ static int pcbit_stat(u_char __user *buf, int len, int driver, int channel) 


	if (stat_st < stat_end)

	{

		copy_to_user(buf, statbuf + stat_st, len);

		if (copy_to_user(buf, statbuf + stat_st, len))

			return -EFAULT;

		stat_st += len;	   

	}

	else

	{

		if (len > STATBUF_LEN - stat_st)

		{

			copy_to_user(buf, statbuf + stat_st, 

				       STATBUF_LEN - stat_st);

			copy_to_user(buf, statbuf, 

				       len - (STATBUF_LEN - stat_st));

			if (copy_to_user(buf, statbuf + stat_st,

				       STATBUF_LEN - stat_st))

				return -EFAULT;

			if (copy_to_user(buf, statbuf,

				       len - (STATBUF_LEN - stat_st)))

				return -EFAULT;



			stat_st = len - (STATBUF_LEN - stat_st);

		}

		else

		{

			copy_to_user(buf, statbuf + stat_st, len);

			if (copy_to_user(buf, statbuf + stat_st, len))

				return -EFAULT;



			stat_st += len;