The patch titled
ISDN: check for userspace copy faults
has been added to the -mm tree. Its filename is
isdn-check-for-userspace-copy-faults.patch
See http://www.zip.com.au/~akpm/linux/patches/stuff/added-to-mm.txt to find
out what to do about this
------------------------------------------------------
Subject: ISDN: check for userspace copy faults
From: Jeff Garzik <jeff@xxxxxxxxxx>
Most of the ISDN ->readstat() implementations needed to check
copy_to_user() and put_user() return values.
Signed-off-by: Jeff Garzik <jeff@xxxxxxxxxx>
Cc: Karsten Keil <kkeil@xxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxx>
---
drivers/isdn/capi/capidrv.c | 3 ++-
drivers/isdn/hisax/config.c | 6 ++++--
drivers/isdn/icn/icn.c | 3 ++-
drivers/isdn/isdnloop/isdnloop.c | 3 ++-
drivers/isdn/pcbit/drv.c | 16 ++++++++++------
5 files changed, 20 insertions(+), 11 deletions(-)
diff -puN drivers/isdn/capi/capidrv.c~isdn-check-for-userspace-copy-faults drivers/isdn/capi/capidrv.c
--- a/drivers/isdn/capi/capidrv.c~isdn-check-for-userspace-copy-faults
+++ a/drivers/isdn/capi/capidrv.c
@@ -1907,7 +1907,8 @@ static int if_readstat(u8 __user *buf, i
}
for (p=buf, count=0; count < len; p++, count++) {
- put_user(*card->q931_read++, p);
+ if (put_user(*card->q931_read++, p))
+ return -EFAULT;
if (card->q931_read > card->q931_end)
card->q931_read = card->q931_buf;
}
diff -puN drivers/isdn/hisax/config.c~isdn-check-for-userspace-copy-faults drivers/isdn/hisax/config.c
--- a/drivers/isdn/hisax/config.c~isdn-check-for-userspace-copy-faults
+++ a/drivers/isdn/hisax/config.c
@@ -631,7 +631,8 @@ static int HiSax_readstatus(u_char __use
count = cs->status_end - cs->status_read + 1;
if (count >= len)
count = len;
- copy_to_user(p, cs->status_read, count);
+ if (copy_to_user(p, cs->status_read, count))
+ return -EFAULT;
cs->status_read += count;
if (cs->status_read > cs->status_end)
cs->status_read = cs->status_buf;
@@ -642,7 +643,8 @@ static int HiSax_readstatus(u_char __use
cnt = HISAX_STATUS_BUFSIZE;
else
cnt = count;
- copy_to_user(p, cs->status_read, cnt);
+ if (copy_to_user(p, cs->status_read, cnt))
+ return -EFAULT;
p += cnt;
cs->status_read += cnt % HISAX_STATUS_BUFSIZE;
count -= cnt;
diff -puN drivers/isdn/icn/icn.c~isdn-check-for-userspace-copy-faults drivers/isdn/icn/icn.c
--- a/drivers/isdn/icn/icn.c~isdn-check-for-userspace-copy-faults
+++ a/drivers/isdn/icn/icn.c
@@ -1010,7 +1010,8 @@ icn_readstatus(u_char __user *buf, int l
for (p = buf, count = 0; count < len; p++, count++) {
if (card->msg_buf_read == card->msg_buf_write)
return count;
- put_user(*card->msg_buf_read++, p);
+ if (put_user(*card->msg_buf_read++, p))
+ return -EFAULT;
if (card->msg_buf_read > card->msg_buf_end)
card->msg_buf_read = card->msg_buf;
}
diff -puN drivers/isdn/isdnloop/isdnloop.c~isdn-check-for-userspace-copy-faults drivers/isdn/isdnloop/isdnloop.c
--- a/drivers/isdn/isdnloop/isdnloop.c~isdn-check-for-userspace-copy-faults
+++ a/drivers/isdn/isdnloop/isdnloop.c
@@ -446,7 +446,8 @@ isdnloop_readstatus(u_char __user *buf,
for (p = buf, count = 0; count < len; p++, count++) {
if (card->msg_buf_read == card->msg_buf_write)
return count;
- put_user(*card->msg_buf_read++, p);
+ if (put_user(*card->msg_buf_read++, p))
+ return -EFAULT;
if (card->msg_buf_read > card->msg_buf_end)
card->msg_buf_read = card->msg_buf;
}
diff -puN drivers/isdn/pcbit/drv.c~isdn-check-for-userspace-copy-faults drivers/isdn/pcbit/drv.c
--- a/drivers/isdn/pcbit/drv.c~isdn-check-for-userspace-copy-faults
+++ a/drivers/isdn/pcbit/drv.c
@@ -725,23 +725,27 @@ static int pcbit_stat(u_char __user *buf
if (stat_st < stat_end)
{
- copy_to_user(buf, statbuf + stat_st, len);
+ if (copy_to_user(buf, statbuf + stat_st, len))
+ return -EFAULT;
stat_st += len;
}
else
{
if (len > STATBUF_LEN - stat_st)
{
- copy_to_user(buf, statbuf + stat_st,
- STATBUF_LEN - stat_st);
- copy_to_user(buf, statbuf,
- len - (STATBUF_LEN - stat_st));
+ if (copy_to_user(buf, statbuf + stat_st,
+ STATBUF_LEN - stat_st))
+ return -EFAULT;
+ if (copy_to_user(buf, statbuf,
+ len - (STATBUF_LEN - stat_st)))
+ return -EFAULT;
stat_st = len - (STATBUF_LEN - stat_st);
}
else
{
- copy_to_user(buf, statbuf + stat_st, len);
+ if (copy_to_user(buf, statbuf + stat_st, len))
+ return -EFAULT;
stat_st += len;
_
Patches currently in -mm which might be from jeff@xxxxxxxxxx are
origin.patch
tpm-fix-error-handling.patch
x86-microcode-handle-sysfs-error.patch
firmware-dell_rbu-handle-sysfs-errors.patch
ipmi-handle-sysfs-errors.patch
eisa-handle-sysfs-errors.patch
firmware-efivars-handle-error.patch
drivers-mca-handle-sysfs-errors.patch
isdn-several-minor-fixes.patch
fix-up-a-multitude-of-acpi-compiler-warnings-on-x86_64.patch
cpufreq-handle-sysfs-errors.patch
drm-fix-error-returns-sysfs-error-handling.patch
git-dvb.patch
i2c-buses-scx200_acb-handle-pci-errors.patch
input-handle-sysfs-errors.patch
input-drivers-handle-sysfs-errors.patch
git-libata-all.patch
ata-must-depend-on-block.patch
pci_module_init-conversion-for-pata_pdc2027x.patch
libata-return-sense-data-in-hdio_drive_cmd-ioctl.patch
via-pata-controller-xfer-fixes.patch
ahci-ati-sb600-sata-support-for-various-modes.patch
git-mtd.patch
git-netdev-all.patch
libphy-dont-do-that.patch
update-smc91x-driver-with-arm-versatile-board-info.patch
b44-fix-eeprom-endianess-issue.patch
forcedeth-power-management-support.patch
remove-unnecessary-check-in-drivers-net-depcac.patch
8139too-force-media-setting-fix.patch
ibmveth-irq-fix.patch
ehea-firmware-interface-based-on-anton-blanchards-new-hvcall-interface.patch
tulip-fix-shutdown-dma-irq-race.patch
drivers-dma-handle-sysfs-errors.patch
atm-firestream-handle-thrown-error.patch
wan-pc300-handle-propagate-minor-errors.patch
r8169-driver-corega-support-patch.patch
git-pciseg.patch
scsi-minor-bug-fixes-and-cleanups.patch
watchdog-itco_wdt-fix-bug-related-to-gcc-uninit-warning.patch
airo-suspend-fix.patch
drivers-led-handle-sysfs-errors.patch
i2o-handle-a-few-sysfs-errors.patch
fs-partitions-check-add-sysfs-error-handling.patch
rtc-fix-printk-of-64-bit-res-on-32-bit-platform.patch
isdn-fix-drivers-by-handling-errors-thrown-by-readstat.patch
isdn-check-for-userspace-copy-faults.patch
atyfb-rivafb-minor-fixes.patch
md-conditionalize-some-code.patch
git-gccbug.patch
-
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
