This fix adds checks for inspecting the return value of put_user() and return -EFAULT on error. Signed-off-by: Kumar Amit Mehta <gmate.amit@xxxxxxxxx> --- drivers/staging/dgrp/dgrp_tty.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/drivers/staging/dgrp/dgrp_tty.c b/drivers/staging/dgrp/dgrp_tty.c index e125b03..b294197 100644 --- a/drivers/staging/dgrp/dgrp_tty.c +++ b/drivers/staging/dgrp/dgrp_tty.c @@ -2265,7 +2265,8 @@ static int get_modem_info(struct ch_struct *ch, unsigned int *value) | ((mlast & DM_RI) ? TIOCM_RNG : 0) | ((mlast & DM_DSR) ? TIOCM_DSR : 0) | ((mlast & DM_CTS) ? TIOCM_CTS : 0); - put_user(mlast, (unsigned int __user *) value); + if (put_user(mlast, (unsigned int __user *) value)) + return -EFAULT; return 0; } @@ -2620,7 +2621,8 @@ static int dgrp_tty_ioctl(struct tty_struct *tty, unsigned int cmd, sizeof(long)); if (rc == 0) return -EFAULT; - put_user(C_CLOCAL(tty) ? 1 : 0, (unsigned long __user *) arg); + if (put_user(C_CLOCAL(tty) ? 1 : 0, (unsigned long __user *) arg)) + return -EFAULT; return 0; case TIOCSSOFTCAR: @@ -2854,7 +2856,8 @@ static int dgrp_tty_ioctl(struct tty_struct *tty, unsigned int cmd, rc = access_ok(VERIFY_WRITE, (void __user *) arg, sizeof(int)); if (rc == 0) return -EFAULT; - put_user(ch->ch_custom_speed, (unsigned int __user *) arg); + if (put_user(ch->ch_custom_speed, (unsigned int __user *) arg)) + return -EFAULT; break; case DIGI_SETCUSTOMBAUD: -- 1.7.9.5 _______________________________________________ devel mailing list devel@xxxxxxxxxxxxxxxxxxxxxx http://driverdev.linuxdriverproject.org/mailman/listinfo/devel
