* [PATCH] check copy_*_user return values in remaining WAN drivers
@ 2003-05-26 17:50 Paulo Andre'
0 siblings, 0 replies; only message in thread
From: Paulo Andre' @ 2003-05-26 17:50 UTC (permalink / raw)
To: Linus Torvalds; +Cc: linux-kernel
[-- Attachment #1: Type: text/plain, Size: 550 bytes --]
The following patch adds error checking to the copy_*_user() functions
to the remaining WAN drivers which did not have this checking made. I'm
sending a single patch as it's the same change in all files. Affected
files are:
drivers/net/wan/comx-hw-comx.c
drivers/net/wan/comx-hw-locomx.c
drivers/net/wan/comx-hw-mixcom.c
drivers/net/wan/comx-hw-munich.c
drivers/net/wan/comx-proto-fr.c
drivers/net/wan/comx-proto-lapb.c
drivers/net/wan/pc300_drv.c
drivers/net/wan/sbni.c
Applies cleanly on top of latest bk(-19). Please consider applying.
Paulo
[-- Attachment #2: patch-drivers_net_wan.diff --]
[-- Type: text/plain, Size: 5523 bytes --]
diff -urN -X dontdiff linux-2.5-vanilla/drivers/net/wan/comx-hw-comx.c linux/drivers/net/wan/comx-hw-comx.c
--- linux-2.5-vanilla/drivers/net/wan/comx-hw-comx.c 2003-05-26 15:43:32.000000000 +0100
+++ linux/drivers/net/wan/comx-hw-comx.c 2003-05-26 15:49:25.000000000 +0100
@@ -1084,7 +1084,8 @@
if (hw->firmware->data) {
kfree(hw->firmware->data);
}
- copy_from_user(tmp + file->f_pos, buffer, count);
+ if (copy_from_user(tmp + file->f_pos, buffer, count))
+ return -EFAULT;
hw->firmware->len = entry->size = file->f_pos + count;
hw->firmware->data = tmp;
file->f_pos += count;
diff -urN -X dontdiff linux-2.5-vanilla/drivers/net/wan/comx-hw-locomx.c linux/drivers/net/wan/comx-hw-locomx.c
--- linux-2.5-vanilla/drivers/net/wan/comx-hw-locomx.c 2003-05-26 15:43:32.000000000 +0100
+++ linux/drivers/net/wan/comx-hw-locomx.c 2003-05-26 15:49:25.000000000 +0100
@@ -339,7 +339,10 @@
return -ENOMEM;
}
- copy_from_user(page, buffer, count = min_t(unsigned long, count, PAGE_SIZE));
+ if (copy_from_user(page, buffer, count = min_t(unsigned long, count, PAGE_SIZE))) {
+ free_page((unsigned long)page);
+ return -EBADF;
+ }
if (*(page + count - 1) == '\n') {
*(page + count - 1) = 0;
}
diff -urN -X dontdiff linux-2.5-vanilla/drivers/net/wan/comx-hw-mixcom.c linux/drivers/net/wan/comx-hw-mixcom.c
--- linux-2.5-vanilla/drivers/net/wan/comx-hw-mixcom.c 2003-05-26 15:43:32.000000000 +0100
+++ linux/drivers/net/wan/comx-hw-mixcom.c 2003-05-26 15:49:25.000000000 +0100
@@ -763,7 +763,10 @@
return -ENOMEM;
}
- copy_from_user(page, buffer, count = min_t(unsigned long, count, PAGE_SIZE));
+ if (copy_from_user(page, buffer, count = min_t(unsigned long, count, PAGE_SIZE))) {
+ free_page((unsigned long)page);
+ return -EFAULT;
+ }
if (*(page + count - 1) == '\n') {
*(page + count - 1) = 0;
}
diff -urN -X dontdiff linux-2.5-vanilla/drivers/net/wan/comx-hw-munich.c linux/drivers/net/wan/comx-hw-munich.c
--- linux-2.5-vanilla/drivers/net/wan/comx-hw-munich.c 2003-05-26 15:43:32.000000000 +0100
+++ linux/drivers/net/wan/comx-hw-munich.c 2003-05-26 15:49:25.000000000 +0100
@@ -2414,7 +2414,10 @@
return -ENOMEM;
/* Copy user data and cut trailing \n */
- copy_from_user(page, buffer, count = min(count, PAGE_SIZE));
+ if (copy_from_user(page, buffer, count = min(count, PAGE_SIZE))) {
+ free_page((unsigned long)page);
+ return -EFAULT;
+ }
if (*(page + count - 1) == '\n')
*(page + count - 1) = 0;
*(page + PAGE_SIZE - 1) = 0;
diff -urN -X dontdiff linux-2.5-vanilla/drivers/net/wan/comx-proto-fr.c linux/drivers/net/wan/comx-proto-fr.c
--- linux-2.5-vanilla/drivers/net/wan/comx-proto-fr.c 2003-05-26 15:43:32.000000000 +0100
+++ linux/drivers/net/wan/comx-proto-fr.c 2003-05-26 15:49:25.000000000 +0100
@@ -657,7 +657,10 @@
return -ENOMEM;
}
- copy_from_user(page, buffer, count);
+ if (copy_from_user(page, buffer, count)) {
+ free_page((unsigned long)page);
+ return -EFAULT;
+ }
if (*(page + count - 1) == '\n') {
*(page + count - 1) = 0;
}
diff -urN -X dontdiff linux-2.5-vanilla/drivers/net/wan/comx-proto-lapb.c linux/drivers/net/wan/comx-proto-lapb.c
--- linux-2.5-vanilla/drivers/net/wan/comx-proto-lapb.c 2003-05-26 15:43:32.000000000 +0100
+++ linux/drivers/net/wan/comx-proto-lapb.c 2003-05-26 15:49:25.000000000 +0100
@@ -232,7 +232,10 @@
return -ENOMEM;
}
- copy_from_user(page, buffer, count);
+ if (copy_from_user(page, buffer, count)) {
+ free_page((unsigned long)page);
+ return -EFAULT;
+ }
if (*(page + count - 1) == '\n') {
*(page + count - 1) = 0;
}
diff -urN -X dontdiff linux-2.5-vanilla/drivers/net/wan/pc300_drv.c linux/drivers/net/wan/pc300_drv.c
--- linux-2.5-vanilla/drivers/net/wan/pc300_drv.c 2003-05-25 15:30:15.000000000 +0100
+++ linux/drivers/net/wan/pc300_drv.c 2003-05-26 15:49:25.000000000 +0100
@@ -2623,7 +2623,8 @@
sizeof(struct net_device_stats));
if (card->hw.type == PC300_TE)
memcpy(&pc300stats.te_stats,&chan->falc,sizeof(falc_t));
- copy_to_user(arg, &pc300stats, sizeof(pc300stats_t));
+ if (copy_to_user(arg, &pc300stats, sizeof(pc300stats_t)))
+ return -EFAULT;
}
return 0;
}
diff -urN -X dontdiff linux-2.5-vanilla/drivers/net/wan/sbni.c linux/drivers/net/wan/sbni.c
--- linux-2.5-vanilla/drivers/net/wan/sbni.c 2003-05-25 15:30:15.000000000 +0100
+++ linux/drivers/net/wan/sbni.c 2003-05-26 15:49:25.000000000 +0100
@@ -1290,8 +1290,9 @@
error = verify_area( VERIFY_WRITE, ifr->ifr_data,
sizeof(struct sbni_in_stats) );
if( !error )
- copy_to_user( ifr->ifr_data, &nl->in_stats,
- sizeof(struct sbni_in_stats) );
+ if (copy_to_user( ifr->ifr_data, &nl->in_stats,
+ sizeof(struct sbni_in_stats) ))
+ return -EFAULT;
break;
case SIOCDEVRESINSTATS :
@@ -1310,7 +1311,8 @@
error = verify_area( VERIFY_WRITE, ifr->ifr_data,
sizeof flags );
if( !error )
- copy_to_user( ifr->ifr_data, &flags, sizeof flags );
+ if (copy_to_user( ifr->ifr_data, &flags, sizeof flags ))
+ return -EFAULT;
break;
case SIOCDEVSHWSTATE :
@@ -1342,7 +1344,8 @@
sizeof slave_name )) != 0 )
return error;
- copy_from_user( slave_name, ifr->ifr_data, sizeof slave_name );
+ if (copy_from_user( slave_name, ifr->ifr_data, sizeof slave_name ))
+ return -EFAULT;
slave_dev = dev_get_by_name( slave_name );
if( !slave_dev || !(slave_dev->flags & IFF_UP) ) {
printk( KERN_ERR "%s: trying to enslave non-active "
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2003-05-26 17:36 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2003-05-26 17:50 [PATCH] check copy_*_user return values in remaining WAN drivers Paulo Andre'
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).