Commit de8c4ff8 authored by Andrew Morton's avatar Andrew Morton Committed by Linus Torvalds

[PATCH] Add missing sjcd uaccess checks

From: Felipe W Damasio <felipewd@terra.com.br>

Check the return of copy_from_user in a few places to not use buggy
structures if copy_from_user != 0.  Found by smatch.
parent 0af65687
...@@ -842,8 +842,9 @@ static int sjcd_ioctl(struct inode *ip, struct file *fp, ...@@ -842,8 +842,9 @@ static int sjcd_ioctl(struct inode *ip, struct file *fp,
CDROM_AUDIO_NO_STATUS; CDROM_AUDIO_NO_STATUS;
} }
copy_from_user(&sjcd_msf, (void *) arg, if (copy_from_user(&sjcd_msf, (void *) arg,
sizeof(sjcd_msf)); sizeof(sjcd_msf)))
return (-EFAULT);
sjcd_playing.start.min = sjcd_playing.start.min =
bin2bcd(sjcd_msf.cdmsf_min0); bin2bcd(sjcd_msf.cdmsf_min0);
...@@ -893,9 +894,9 @@ static int sjcd_ioctl(struct inode *ip, struct file *fp, ...@@ -893,9 +894,9 @@ static int sjcd_ioctl(struct inode *ip, struct file *fp,
sizeof(toc_entry))) == 0) { sizeof(toc_entry))) == 0) {
struct sjcd_hw_disk_info *tp; struct sjcd_hw_disk_info *tp;
copy_from_user(&toc_entry, (void *) arg, if (copy_from_user(&toc_entry, (void *) arg,
sizeof(toc_entry)); sizeof(toc_entry)))
return (-EFAULT);
if (toc_entry.cdte_track == CDROM_LEADOUT) if (toc_entry.cdte_track == CDROM_LEADOUT)
tp = &sjcd_table_of_contents[0]; tp = &sjcd_table_of_contents[0];
else if (toc_entry.cdte_track < else if (toc_entry.cdte_track <
...@@ -948,8 +949,10 @@ static int sjcd_ioctl(struct inode *ip, struct file *fp, ...@@ -948,8 +949,10 @@ static int sjcd_ioctl(struct inode *ip, struct file *fp,
sizeof(subchnl))) == 0) { sizeof(subchnl))) == 0) {
struct sjcd_hw_qinfo q_info; struct sjcd_hw_qinfo q_info;
copy_from_user(&subchnl, (void *) arg, if (copy_from_user(&subchnl, (void *) arg,
sizeof(subchnl)); sizeof(subchnl)))
return (-EFAULT);
if (sjcd_get_q_info(&q_info) < 0) if (sjcd_get_q_info(&q_info) < 0)
return (-EIO); return (-EIO);
...@@ -1005,8 +1008,9 @@ static int sjcd_ioctl(struct inode *ip, struct file *fp, ...@@ -1005,8 +1008,9 @@ static int sjcd_ioctl(struct inode *ip, struct file *fp,
sizeof(vol_ctrl))) == 0) { sizeof(vol_ctrl))) == 0) {
unsigned char dummy[4]; unsigned char dummy[4];
copy_from_user(&vol_ctrl, (void *) arg, if (copy_from_user(&vol_ctrl, (void *) arg,
sizeof(vol_ctrl)); sizeof(vol_ctrl)))
return (-EFAULT);
sjcd_send_4_cmd(SCMD_SET_VOLUME, sjcd_send_4_cmd(SCMD_SET_VOLUME,
vol_ctrl.channel0, 0xFF, vol_ctrl.channel0, 0xFF,
vol_ctrl.channel1, 0xFF); vol_ctrl.channel1, 0xFF);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment