--=_courier-31540-1053971429-0001-2
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
The following patch adds error checking to the copy_*_user() functions
to the remaining WAN drivers which did not have this checking made. I'm
sending a single patch as it's the same change in all files. Affected
files are:
drivers/net/wan/comx-hw-comx.c
drivers/net/wan/comx-hw-locomx.c
drivers/net/wan/comx-hw-mixcom.c
drivers/net/wan/comx-hw-munich.c
drivers/net/wan/comx-proto-fr.c
drivers/net/wan/comx-proto-lapb.c
drivers/net/wan/pc300_drv.c
drivers/net/wan/sbni.c
Applies cleanly on top of latest bk(-19). Please consider applying.
Paulo
--=_courier-31540-1053971429-0001-2
Content-Type: text/plain; name="patch-drivers_net_wan.diff"; charset=iso-8859-1
Content-Transfer-Encoding: 7bit
Content-disposition: attachment; filename=patch-drivers_net_wan.diff
diff -urN -X dontdiff linux-2.5-vanilla/drivers/net/wan/comx-hw-comx.c linux/drivers/net/wan/comx-hw-comx.c
--- linux-2.5-vanilla/drivers/net/wan/comx-hw-comx.c 2003-05-26 15:43:32.000000000 +0100
+++ linux/drivers/net/wan/comx-hw-comx.c 2003-05-26 15:49:25.000000000 +0100
@@ -1084,7 +1084,8 @@
if (hw->firmware->data) {
kfree(hw->firmware->data);
}
- copy_from_user(tmp + file->f_pos, buffer, count);
+ if (copy_from_user(tmp + file->f_pos, buffer, count))
+ return -EFAULT;
hw->firmware->len = entry->size = file->f_pos + count;
hw->firmware->data = tmp;
file->f_pos += count;
diff -urN -X dontdiff linux-2.5-vanilla/drivers/net/wan/comx-hw-locomx.c linux/drivers/net/wan/comx-hw-locomx.c
--- linux-2.5-vanilla/drivers/net/wan/comx-hw-locomx.c 2003-05-26 15:43:32.000000000 +0100
+++ linux/drivers/net/wan/comx-hw-locomx.c 2003-05-26 15:49:25.000000000 +0100
@@ -339,7 +339,10 @@
return -ENOMEM;
}
- copy_from_user(page, buffer, count = min_t(unsigned long, count, PAGE_SIZE));
+ if (copy_from_user(page, buffer, count = min_t(unsigned long, count, PAGE_SIZE))) {
+ free_page((unsigned long)page);
+ return -EBADF;
+ }
if (*(page + count - 1) == '\n') {
*(page + count - 1) = 0;
}
diff -urN -X dontdiff linux-2.5-vanilla/drivers/net/wan/comx-hw-mixcom.c linux/drivers/net/wan/comx-hw-mixcom.c
--- linux-2.5-vanilla/drivers/net/wan/comx-hw-mixcom.c 2003-05-26 15:43:32.000000000 +0100
+++ linux/drivers/net/wan/comx-hw-mixcom.c 2003-05-26 15:49:25.000000000 +0100
@@ -763,7 +763,10 @@
return -ENOMEM;
}
- copy_from_user(page, buffer, count = min_t(unsigned long, count, PAGE_SIZE));
+ if (copy_from_user(page, buffer, count = min_t(unsigned long, count, PAGE_SIZE))) {
+ free_page((unsigned long)page);
+ return -EFAULT;
+ }
if (*(page + count - 1) == '\n') {
*(page + count - 1) = 0;
}
diff -urN -X dontdiff linux-2.5-vanilla/drivers/net/wan/comx-hw-munich.c linux/drivers/net/wan/comx-hw-munich.c
--- linux-2.5-vanilla/drivers/net/wan/comx-hw-munich.c 2003-05-26 15:43:32.000000000 +0100
+++ linux/drivers/net/wan/comx-hw-munich.c 2003-05-26 15:49:25.000000000 +0100
@@ -2414,7 +2414,10 @@
return -ENOMEM;
/* Copy user data and cut trailing \n */
- copy_from_user(page, buffer, count = min(count, PAGE_SIZE));
+ if (copy_from_user(page, buffer, count = min(count, PAGE_SIZE))) {
+ free_page((unsigned long)page);
+ return -EFAULT;
+ }
if (*(page + count - 1) == '\n')
*(page + count - 1) = 0;
*(page + PAGE_SIZE - 1) = 0;
diff -urN -X dontdiff linux-2.5-vanilla/drivers/net/wan/comx-proto-fr.c linux/drivers/net/wan/comx-proto-fr.c
--- linux-2.5-vanilla/drivers/net/wan/comx-proto-fr.c 2003-05-26 15:43:32.000000000 +0100
+++ linux/drivers/net/wan/comx-proto-fr.c 2003-05-26 15:49:25.000000000 +0100
@@ -657,7 +657,10 @@
return -ENOMEM;
}
- copy_from_user(page, buffer, count);
+ if (copy_from_user(page, buffer, count)) {
+ free_page((unsigned long)page);
+ return -EFAULT;
+ }
if (*(page + count - 1) == '\n') {
*(page + count - 1) = 0;
}
diff -urN -X dontdiff linux-2.5-vanilla/drivers/net/wan/comx-proto-lapb.c linux/drivers/net/wan/comx-proto-lapb.c
--- linux-2.5-vanilla/drivers/net/wan/comx-proto-lapb.c 2003-05-26 15:43:32.000000000 +0100
+++ linux/drivers/net/wan/comx-proto-lapb.c 2003-05-26 15:49:25.000000000 +0100
@@ -232,7 +232,10 @@
return -ENOMEM;
}
- copy_from_user(page, buffer, count);
+ if (copy_from_user(page, buffer, count)) {
+ free_page((unsigned long)page);
+ return -EFAULT;
+ }
if (*(page + count - 1) == '\n') {
*(page + count - 1) = 0;
}
diff -urN -X dontdiff linux-2.5-vanilla/drivers/net/wan/pc300_drv.c linux/drivers/net/wan/pc300_drv.c
--- linux-2.5-vanilla/drivers/net/wan/pc300_drv.c 2003-05-25 15:30:15.000000000 +0100
+++ linux/drivers/net/wan/pc300_drv.c 2003-05-26 15:49:25.000000000 +0100
@@ -2623,7 +2623,8 @@
sizeof(struct net_device_stats));
if (card->hw.type == PC300_TE)
memcpy(&pc300stats.te_stats,&chan->falc,sizeof(falc_t));
- copy_to_user(arg, &pc300stats, sizeof(pc300stats_t));
+ if (copy_to_user(arg, &pc300stats, sizeof(pc300stats_t)))
+ return -EFAULT;
}
return 0;
}
diff -urN -X dontdiff linux-2.5-vanilla/drivers/net/wan/sbni.c linux/drivers/net/wan/sbni.c
--- linux-2.5-vanilla/drivers/net/wan/sbni.c 2003-05-25 15:30:15.000000000 +0100
+++ linux/drivers/net/wan/sbni.c 2003-05-26 15:49:25.000000000 +0100
@@ -1290,8 +1290,9 @@
error = verify_area( VERIFY_WRITE, ifr->ifr_data,
sizeof(struct sbni_in_stats) );
if( !error )
- copy_to_user( ifr->ifr_data, &nl->in_stats,
- sizeof(struct sbni_in_stats) );
+ if (copy_to_user( ifr->ifr_data, &nl->in_stats,
+ sizeof(struct sbni_in_stats) ))
+ return -EFAULT;
break;
case SIOCDEVRESINSTATS :
@@ -1310,7 +1311,8 @@
error = verify_area( VERIFY_WRITE, ifr->ifr_data,
sizeof flags );
if( !error )
- copy_to_user( ifr->ifr_data, &flags, sizeof flags );
+ if (copy_to_user( ifr->ifr_data, &flags, sizeof flags ))
+ return -EFAULT;
break;
case SIOCDEVSHWSTATE :
@@ -1342,7 +1344,8 @@
sizeof slave_name )) != 0 )
return error;
- copy_from_user( slave_name, ifr->ifr_data, sizeof slave_name );
+ if (copy_from_user( slave_name, ifr->ifr_data, sizeof slave_name ))
+ return -EFAULT;
slave_dev = dev_get_by_name( slave_name );
if( !slave_dev || !(slave_dev->flags & IFF_UP) ) {
printk( KERN_ERR "%s: trying to enslave non-active "
--=_courier-31540-1053971429-0001-2--