summaryrefslogtreecommitdiffstats
path: root/fs/compat_ioctl.c
diff options
context:
space:
mode:
authorHeiko Carstens <heiko.carstens@de.ibm.com>2006-12-06 20:36:36 -0800
committerLinus Torvalds <torvalds@woody.osdl.org>2006-12-07 08:39:33 -0800
commit7116e994b47f3988389be4ceee67dac64b56e0d0 (patch)
treef6b722a14cba117898456c3a9edbe7538310db2f /fs/compat_ioctl.c
parent841d5fb7c75260f76ae682648b28a3dca724940d (diff)
downloadlinux-7116e994b47f3988389be4ceee67dac64b56e0d0.tar.gz
linux-7116e994b47f3988389be4ceee67dac64b56e0d0.tar.bz2
linux-7116e994b47f3988389be4ceee67dac64b56e0d0.zip
[PATCH] compat: fix uaccess handling
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com> Cc: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Diffstat (limited to 'fs/compat_ioctl.c')
-rw-r--r--fs/compat_ioctl.c33
1 files changed, 20 insertions, 13 deletions
diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c
index a91f2628c981..6e3177685556 100644
--- a/fs/compat_ioctl.c
+++ b/fs/compat_ioctl.c
@@ -211,8 +211,10 @@ static int do_video_stillpicture(unsigned int fd, unsigned int cmd, unsigned lon
up_native =
compat_alloc_user_space(sizeof(struct video_still_picture));
- put_user(compat_ptr(fp), &up_native->iFrame);
- put_user(size, &up_native->size);
+ err = put_user(compat_ptr(fp), &up_native->iFrame);
+ err |= put_user(size, &up_native->size);
+ if (err)
+ return -EFAULT;
err = sys_ioctl(fd, cmd, (unsigned long) up_native);
@@ -236,8 +238,10 @@ static int do_video_set_spu_palette(unsigned int fd, unsigned int cmd, unsigned
err |= get_user(length, &up->length);
up_native = compat_alloc_user_space(sizeof(struct video_spu_palette));
- put_user(compat_ptr(palp), &up_native->palette);
- put_user(length, &up_native->length);
+ err = put_user(compat_ptr(palp), &up_native->palette);
+ err |= put_user(length, &up_native->length);
+ if (err)
+ return -EFAULT;
err = sys_ioctl(fd, cmd, (unsigned long) up_native);
@@ -2043,16 +2047,19 @@ static int serial_struct_ioctl(unsigned fd, unsigned cmd, unsigned long arg)
struct serial_struct ss;
mm_segment_t oldseg = get_fs();
__u32 udata;
+ unsigned int base;
if (cmd == TIOCSSERIAL) {
if (!access_ok(VERIFY_READ, ss32, sizeof(SS32)))
return -EFAULT;
if (__copy_from_user(&ss, ss32, offsetof(SS32, iomem_base)))
return -EFAULT;
- __get_user(udata, &ss32->iomem_base);
+ if (__get_user(udata, &ss32->iomem_base))
+ return -EFAULT;
ss.iomem_base = compat_ptr(udata);
- __get_user(ss.iomem_reg_shift, &ss32->iomem_reg_shift);
- __get_user(ss.port_high, &ss32->port_high);
+ if (__get_user(ss.iomem_reg_shift, &ss32->iomem_reg_shift) ||
+ __get_user(ss.port_high, &ss32->port_high))
+ return -EFAULT;
ss.iomap_base = 0UL;
}
set_fs(KERNEL_DS);
@@ -2063,12 +2070,12 @@ static int serial_struct_ioctl(unsigned fd, unsigned cmd, unsigned long arg)
return -EFAULT;
if (__copy_to_user(ss32,&ss,offsetof(SS32,iomem_base)))
return -EFAULT;
- __put_user((unsigned long)ss.iomem_base >> 32 ?
- 0xffffffff : (unsigned)(unsigned long)ss.iomem_base,
- &ss32->iomem_base);
- __put_user(ss.iomem_reg_shift, &ss32->iomem_reg_shift);
- __put_user(ss.port_high, &ss32->port_high);
-
+ base = (unsigned long)ss.iomem_base >> 32 ?
+ 0xffffffff : (unsigned)(unsigned long)ss.iomem_base;
+ if (__put_user(base, &ss32->iomem_base) ||
+ __put_user(ss.iomem_reg_shift, &ss32->iomem_reg_shift) ||
+ __put_user(ss.port_high, &ss32->port_high))
+ return -EFAULT;
}
return err;
}