drivers/char/*

	- fix copy_{to,from}_user error handling, thanks to Rusty to pointing this out on lkml

diff --git a/drivers/char/epca.c b/drivers/char/epca.c
index 21f270d0d14db59506ac09ebcfdcf09639f032c2..d90d0d973380759bed47c23aea57c0f51a7148c2 100644 (file)
--- a/drivers/char/epca.c
+++ b/drivers/char/epca.c
@@ -907,7 +907,9 @@ static int pc_write(struct tty_struct * tty, int from_user,
                                
                                ----------------------------------------------------------------- */
 
-                               copy_from_user(ch->tmp_buf, buf, bytesAvailable);
+                               if (copy_from_user(ch->tmp_buf, buf,
+                                                  bytesAvailable))
+                                       return -EFAULT;
 
                        } /* End if area verified */
 
@@ -2999,7 +3001,8 @@ static int pc_ioctl(struct tty_struct *tty, struct file * file,
                                di.port = boards[brd].port ;
                                di.membase = boards[brd].membase ;
 
-                               copy_to_user((char *)arg, &di, sizeof (di));
+                               if (copy_to_user((char *)arg, &di, sizeof (di)))
+                                       return -EFAULT;
                                break;
 
                        } /* End case DIGI_GETINFO */
@@ -3068,14 +3071,9 @@ static int pc_ioctl(struct tty_struct *tty, struct file * file,
        { /* Begin switch cmd */
 
                case TCGETS:
-                       retval = verify_area(VERIFY_WRITE, (void *)arg,
-                              sizeof(struct termios));
-                       
-                       if (retval)
-                               return(retval);
-
-                       copy_to_user((struct termios *)arg, 
-                                    tty->termios, sizeof(struct termios));
+                       if (copy_to_user((struct termios *)arg, 
+                                        tty->termios, sizeof(struct termios)))
+                               return -EFAULT;
                        return(0);
 
                case TCGETA:
@@ -3235,14 +3233,9 @@ static int pc_ioctl(struct tty_struct *tty, struct file * file,
                        break;
 
                case DIGI_GETA:
-                       if ((error=
-                               verify_area(VERIFY_WRITE, (char*)arg, sizeof(digi_t))))
-                       {
-                               printk(KERN_ERR "<Error> - Digi GETA failed\n");
-                               return(error);
-                       }
-
-                       copy_to_user((char*)arg, &ch->digiext, sizeof(digi_t));
+                       if (copy_to_user((char*)arg, &ch->digiext,
+                                        sizeof(digi_t)))
+                               return -EFAULT;
                        break;
 
                case DIGI_SETAW:
@@ -3263,11 +3256,9 @@ static int pc_ioctl(struct tty_struct *tty, struct file * file,
                        /* Fall Thru */
 
                case DIGI_SETA:
-                       if ((error =
-                               verify_area(VERIFY_READ, (char*)arg,sizeof(digi_t))))
-                               return(error);
-
-                       copy_from_user(&ch->digiext, (char*)arg, sizeof(digi_t));
+                       if (copy_from_user(&ch->digiext, (char*)arg,
+                                          sizeof(digi_t)))
+                               return -EFAULT;
                        
                        if (ch->digiext.digi_flags & DIGI_ALTPIN) 
                        {
@@ -3310,10 +3301,8 @@ static int pc_ioctl(struct tty_struct *tty, struct file * file,
                        memoff(ch);
                        restore_flags(flags);
 
-                       if ((error = verify_area(VERIFY_WRITE, (char*)arg,sizeof(dflow))))
-                               return(error);
-
-                       copy_to_user((char*)arg, &dflow, sizeof(dflow));
+                       if (copy_to_user((char*)arg, &dflow, sizeof(dflow)))
+                               return -EFAULT;
                        break;
 
                case DIGI_SETAFLOW:
@@ -3329,10 +3318,8 @@ static int pc_ioctl(struct tty_struct *tty, struct file * file,
                                stopc = ch->stopca;
                        }
 
-                       if ((error = verify_area(VERIFY_READ, (char*)arg,sizeof(dflow))))
-                               return(error);
-
-                       copy_from_user(&dflow, (char*)arg, sizeof(dflow));
+                       if (copy_from_user(&dflow, (char*)arg, sizeof(dflow)))
+                               return -EFAULT;
 
                        if (dflow.startc != startc || dflow.stopc != stopc) 
                        { /* Begin  if setflow toggled */

diff --git a/drivers/char/istallion.c b/drivers/char/istallion.c
index e50dd36f4ad7fb1417f3ada17fb2ea8493ce62f8..eab51921c986e4da2f892e3fd4fab81d704d57c9 100644 (file)
--- a/drivers/char/istallion.c
+++ b/drivers/char/istallion.c
@@ -2022,7 +2022,8 @@ static int stli_setserial(stliport_t *portp, struct serial_struct *sp)
        printk("stli_setserial(portp=%x,sp=%x)\n", (int) portp, (int) sp);
 #endif
 
-       copy_from_user(&sio, sp, sizeof(struct serial_struct));
+       if (copy_from_user(&sio, sp, sizeof(struct serial_struct)))
+               return -EFAULT;
        if (!capable(CAP_SYS_ADMIN)) {
                if ((sio.baud_base != portp->baud_base) ||
                    (sio.close_delay != portp->close_delay) ||
@@ -4878,11 +4879,15 @@ static ssize_t stli_memread(struct file *fp, char *buf, size_t count, loff_t *of
        while (size > 0) {
                memptr = (void *) EBRDGETMEMPTR(brdp, fp->f_pos);
                n = MIN(size, (brdp->pagesize - (((unsigned long) fp->f_pos) % brdp->pagesize)));
-               copy_to_user(buf, memptr, n);
+               if (copy_to_user(buf, memptr, n)) {
+                       count = -EFAULT;
+                       goto out;
+               }
                fp->f_pos += n;
                buf += n;
                size -= n;
        }
+out:
        EBRDDISABLE(brdp);
        restore_flags(flags);
 
@@ -4930,11 +4935,15 @@ static ssize_t stli_memwrite(struct file *fp, const char *buf, size_t count, lof
        while (size > 0) {
                memptr = (void *) EBRDGETMEMPTR(brdp, fp->f_pos);
                n = MIN(size, (brdp->pagesize - (((unsigned long) fp->f_pos) % brdp->pagesize)));
-               copy_from_user(memptr, chbuf, n);
+               if (copy_from_user(memptr, chbuf, n)) {
+                       count = -EFAULT;
+                       goto out;
+               }
                fp->f_pos += n;
                chbuf += n;
                size -= n;
        }
+out:
        EBRDDISABLE(brdp);
        restore_flags(flags);
 

diff --git a/drivers/char/machzwd.c b/drivers/char/machzwd.c
index 85ba8321a564b8d84f6cc4643583dff39604c8dc..4145913cf5fcf029b5f63f02e1a3270ad77fc778 100644 (file)
--- a/drivers/char/machzwd.c
+++ b/drivers/char/machzwd.c
@@ -359,20 +359,15 @@ static ssize_t zf_read(struct file *file, char *buf, size_t count,
 static int zf_ioctl(struct inode *inode, struct file *file, unsigned int cmd,
        unsigned long arg)
 {
-       int ret;
-               
        switch(cmd){
                case WDIOC_GETSUPPORT:
-                       ret = copy_to_user((struct watchdog_info *)arg, 
-                                               &zf_info, sizeof(zf_info));
-                       if(ret)
+                       if (copy_to_user((struct watchdog_info *)arg, 
+                                        &zf_info, sizeof(zf_info)))
                                return -EFAULT;
                        break;
          
                case WDIOC_GETSTATUS:
-                       ret = copy_to_user((int *)arg, &zf_is_open,
-                                                               sizeof(int));
-                       if(ret)
+                       if (copy_to_user((int *)arg, &zf_is_open, sizeof(int)))
                                return -EFAULT;
                        break;
 

diff --git a/drivers/char/mxser.c b/drivers/char/mxser.c
index f6e059693c6b5ac892b02c99b0c2e318cd29c547..b6d3ea88ebac61edf9b215709e4ccf79b9f5d0c4 100644 (file)
--- a/drivers/char/mxser.c
+++ b/drivers/char/mxser.c
@@ -2175,8 +2175,7 @@ static int mxser_get_serial_info(struct mxser_struct *info,
        tmp.closing_wait = info->closing_wait;
        tmp.custom_divisor = info->custom_divisor;
        tmp.hub6 = 0;
-       copy_to_user(retinfo, &tmp, sizeof(*retinfo));
-       return (0);
+       return copy_to_user(retinfo, &tmp, sizeof(*retinfo)) ? -EFAULT : 0;
 }
 
 static int mxser_set_serial_info(struct mxser_struct *info,
@@ -2188,7 +2187,8 @@ static int mxser_set_serial_info(struct mxser_struct *info,
 
        if (!new_info || !info->base)
                return (-EFAULT);
-       copy_from_user(&new_serial, new_info, sizeof(new_serial));
+       if (copy_from_user(&new_serial, new_info, sizeof(new_serial)))
+               return -EFAULT;
 
        if ((new_serial.irq != info->irq) ||
            (new_serial.port != info->base) ||

diff --git a/drivers/char/n_r3964.c b/drivers/char/n_r3964.c
index 849b91296412237ec604ae4de5a3a41cbae116e2..47effb41f46e486366459d05ce9bf4a0646c73e9 100644 (file)
--- a/drivers/char/n_r3964.c
+++ b/drivers/char/n_r3964.c
@@ -1364,7 +1364,7 @@ static ssize_t r3964_write(struct tty_struct * tty, struct file * file,
       pHeader->owner = pClient;
    }
 
-   copy_from_user (pHeader->data, data, count); /* We already verified this */
+   __copy_from_user(pHeader->data, data, count); /* We already verified this */
 
    if(pInfo->flags & R3964_DEBUG)
    {

diff --git a/drivers/char/nwflash.c b/drivers/char/nwflash.c
index 4022345238f18d74d907b6787d4b5418ec729a17..a5055576aaf3e97f97aa394aa88e134968eff0f8 100644 (file)
--- a/drivers/char/nwflash.c
+++ b/drivers/char/nwflash.c
@@ -159,7 +159,8 @@ static ssize_t flash_read(struct file *file, char *buf, size_t size, loff_t * pp
                if (ret == 0) {
                        ret = count;
                        *ppos += count;
-               }
+               } else
+                       ret = -EFAULT;
                up(&nwflash_sem);
        }
        return ret;

diff --git a/drivers/char/raw.c b/drivers/char/raw.c
index 7b0c47fc129aef688bb33940b6aa5831d4010194..a901f7b1bdbe48547d6127598190c7c01b32fc4e 100644 (file)
--- a/drivers/char/raw.c
+++ b/drivers/char/raw.c
@@ -163,9 +163,10 @@ int raw_ctl_ioctl(struct inode *inode,
 
                /* First, find out which raw minor we want */
 
-               err = copy_from_user(&rq, (void *) arg, sizeof(rq));
-               if (err)
+               if (copy_from_user(&rq, (void *) arg, sizeof(rq))) {
+                       err = -EFAULT;
                        break;
+               }
                
                minor = rq.raw_minor;
                if (minor <= 0 || minor > MINORMASK) {
@@ -222,6 +223,8 @@ int raw_ctl_ioctl(struct inode *inode,
                                rq.block_major = rq.block_minor = 0;
                        }
                        err = copy_to_user((void *) arg, &rq, sizeof(rq));
+                       if (err)
+                               err = -EFAULT;
                }
                break;
                

diff --git a/drivers/char/stallion.c b/drivers/char/stallion.c
index db06f5ad2b10ac70bb974172a3e1272acaa3bed3..c19aa59a62b137f52a4320a5e55e5b9d8e3a3919 100644 (file)
--- a/drivers/char/stallion.c
+++ b/drivers/char/stallion.c
@@ -1553,7 +1553,8 @@ static int stl_setserial(stlport_t *portp, struct serial_struct *sp)
        printk("stl_setserial(portp=%x,sp=%x)\n", (int) portp, (int) sp);
 #endif
 
-       copy_from_user(&sio, sp, sizeof(struct serial_struct));
+       if (copy_from_user(&sio, sp, sizeof(struct serial_struct)))
+               return -EFAULT;
        if (!capable(CAP_SYS_ADMIN)) {
                if ((sio.baud_base != portp->baud_base) ||
                    (sio.close_delay != portp->close_delay) ||
@@ -2949,7 +2950,8 @@ static int stl_getbrdstats(combrd_t *bp)
        stlpanel_t      *panelp;
        int             i;
 
-       copy_from_user(&stl_brdstats, bp, sizeof(combrd_t));
+       if (copy_from_user(&stl_brdstats, bp, sizeof(combrd_t)))
+               return -EFAULT;
        if (stl_brdstats.brd >= STL_MAXBRDS)
                return(-ENODEV);
        brdp = stl_brds[stl_brdstats.brd];
@@ -2973,8 +2975,7 @@ static int stl_getbrdstats(combrd_t *bp)
                stl_brdstats.panels[i].nrports = panelp->nrports;
        }
 
-       copy_to_user(bp, &stl_brdstats, sizeof(combrd_t));
-       return(0);
+       return copy_to_user(bp, &stl_brdstats, sizeof(combrd_t)) ? -EFAULT : 0;
 }
 
 /*****************************************************************************/
@@ -3017,7 +3018,8 @@ static int stl_getportstats(stlport_t *portp, comstats_t *cp)
        unsigned long   flags;
 
        if (portp == (stlport_t *) NULL) {
-               copy_from_user(&stl_comstats, cp, sizeof(comstats_t));
+               if (copy_from_user(&stl_comstats, cp, sizeof(comstats_t)))
+                       return -EFAULT;
                portp = stl_getport(stl_comstats.brd, stl_comstats.panel,
                        stl_comstats.port);
                if (portp == (stlport_t *) NULL)
@@ -3058,8 +3060,8 @@ static int stl_getportstats(stlport_t *portp, comstats_t *cp)
 
        portp->stats.signals = (unsigned long) stl_getsignals(portp);
 
-       copy_to_user(cp, &portp->stats, sizeof(comstats_t));
-       return(0);
+       return copy_to_user(cp, &portp->stats,
+                           sizeof(comstats_t)) ? -EFAULT : 0;
 }
 
 /*****************************************************************************/
@@ -3071,7 +3073,8 @@ static int stl_getportstats(stlport_t *portp, comstats_t *cp)
 static int stl_clrportstats(stlport_t *portp, comstats_t *cp)
 {
        if (portp == (stlport_t *) NULL) {
-               copy_from_user(&stl_comstats, cp, sizeof(comstats_t));
+               if (copy_from_user(&stl_comstats, cp, sizeof(comstats_t)))
+                       return -EFAULT;
                portp = stl_getport(stl_comstats.brd, stl_comstats.panel,
                        stl_comstats.port);
                if (portp == (stlport_t *) NULL)
@@ -3082,8 +3085,8 @@ static int stl_clrportstats(stlport_t *portp, comstats_t *cp)
        portp->stats.brd = portp->brdnr;
        portp->stats.panel = portp->panelnr;
        portp->stats.port = portp->portnr;
-       copy_to_user(cp, &portp->stats, sizeof(comstats_t));
-       return(0);
+       return copy_to_user(cp, &portp->stats,
+                           sizeof(comstats_t)) ? -EFAULT : 0;
 }
 
 /*****************************************************************************/
@@ -3096,13 +3099,14 @@ static int stl_getportstruct(unsigned long arg)
 {
        stlport_t       *portp;
 
-       copy_from_user(&stl_dummyport, (void *) arg, sizeof(stlport_t));
+       if (copy_from_user(&stl_dummyport, (void *) arg, sizeof(stlport_t)))
+               return -EFAULT;
        portp = stl_getport(stl_dummyport.brdnr, stl_dummyport.panelnr,
                 stl_dummyport.portnr);
        if (portp == (stlport_t *) NULL)
                return(-ENODEV);
-       copy_to_user((void *) arg, portp, sizeof(stlport_t));
-       return(0);
+       return copy_to_user((void *)arg, portp,
+                           sizeof(stlport_t)) ? -EFAULT : 0;
 }
 
 /*****************************************************************************/
@@ -3115,14 +3119,14 @@ static int stl_getbrdstruct(unsigned long arg)
 {
        stlbrd_t        *brdp;
 
-       copy_from_user(&stl_dummybrd, (void *) arg, sizeof(stlbrd_t));
+       if (copy_from_user(&stl_dummybrd, (void *) arg, sizeof(stlbrd_t)))
+               return -EFAULT;
        if ((stl_dummybrd.brdnr < 0) || (stl_dummybrd.brdnr >= STL_MAXBRDS))
                return(-ENODEV);
        brdp = stl_brds[stl_dummybrd.brdnr];
        if (brdp == (stlbrd_t *) NULL)
                return(-ENODEV);
-       copy_to_user((void *) arg, brdp, sizeof(stlbrd_t));
-       return(0);
+       return copy_to_user((void *)arg, brdp, sizeof(stlbrd_t)) ? -EFAULT : 0;
 }
 
 /*****************************************************************************/

diff --git a/drivers/char/sx.c b/drivers/char/sx.c
index 947f76a60898fea041ce9d1bc50c36b287feeff8..694b0e1e9283ffc5bde3f2d4747d7ee557335d81 100644 (file)
--- a/drivers/char/sx.c
+++ b/drivers/char/sx.c
@@ -1720,8 +1720,11 @@ static int sx_fw_ioctl (struct inode *inode, struct file *filp,
                Get_user (data,  descr++);
                while (nbytes && data) {
                        for (i=0;i<nbytes;i += SX_CHUNK_SIZE) {
-                               copy_from_user (tmp, (char *)data+i, 
-                                               (i+SX_CHUNK_SIZE>nbytes)?nbytes-i:SX_CHUNK_SIZE);
+                               if (copy_from_user(tmp, (char *)data + i, 
+                                                  (i + SX_CHUNK_SIZE >
+                                                   nbytes) ? nbytes - i :
+                                                             SX_CHUNK_SIZE))
+                                       return -EFAULT;
                                memcpy_toio    ((char *) (board->base2 + offset + i), tmp, 
                                                (i+SX_CHUNK_SIZE>nbytes)?nbytes-i:SX_CHUNK_SIZE);
                        }

diff --git a/drivers/char/tpqic02.c b/drivers/char/tpqic02.c
index 24b490623b147e71481f2a1bfb46d590098fd642..b2c1ce6a248746d4c910331f8b1eef8993775ed8 100644 (file)
--- a/drivers/char/tpqic02.c
+++ b/drivers/char/tpqic02.c
@@ -1944,12 +1944,8 @@ static ssize_t qic02_tape_read(struct file *filp, char *buf, size_t count,
                        }
                        /* copy buffer to user-space in one go */
                        if (bytes_done > 0) {
-                               err =
-                                   copy_to_user(buf, buffaddr,
-                                                bytes_done);
-                               if (err) {
+                               if (copy_to_user(buf, buffaddr, bytes_done))
                                        return -EFAULT;
-                               }
                        }
 #if 1
                        /* Checks Ton's patch below */
@@ -2085,10 +2081,8 @@ static ssize_t qic02_tape_write(struct file *filp, const char *buf,
 
                /* copy from user to DMA buffer and initiate transfer. */
                if (bytes_todo > 0) {
-                       err = copy_from_user(buffaddr, buf, bytes_todo);
-                       if (err) {
+                       if (copy_from_user(buffaddr, buf, bytes_todo))
                                return -EFAULT;
-                       }
 
 /****************** similar problem with read() at FM could happen here at EOT.
  ******************/