drivers/usr/*.c

	- fix copy_{to,from}_user error handling (thanks to Rusty for pointing this out)

diff --git a/drivers/usb/class/audio.c b/drivers/usb/class/audio.c
index b02a3aee8489dafd7a9637afe4220264d6679832..f04db26a2fa0add9f48a3e5c0137a62cb2720447 100644 (file)
--- a/drivers/usb/class/audio.c
+++ b/drivers/usb/class/audio.c
@@ -2542,7 +2542,9 @@ static int usb_audio_ioctl(struct inode *inode, struct file *file, unsigned int
                if (as->usbin.dma.mapped)
                        as->usbin.dma.count &= as->usbin.dma.fragsize-1;
                spin_unlock_irqrestore(&as->lock, flags);
-               return copy_to_user((void *)arg, &cinfo, sizeof(cinfo));
+               if (copy_to_user((void *)arg, &cinfo, sizeof(cinfo)))
+                       return -EFAULT;
+               return 0;
 
        case SNDCTL_DSP_GETOPTR:
                if (!(file->f_mode & FMODE_WRITE))
@@ -2554,7 +2556,9 @@ static int usb_audio_ioctl(struct inode *inode, struct file *file, unsigned int
                if (as->usbout.dma.mapped)
                        as->usbout.dma.count &= as->usbout.dma.fragsize-1;
                spin_unlock_irqrestore(&as->lock, flags);
-               return copy_to_user((void *)arg, &cinfo, sizeof(cinfo));
+               if (copy_to_user((void *)arg, &cinfo, sizeof(cinfo)))
+                       return -EFAULT;
+               return 0;
 
        case SNDCTL_DSP_GETBLKSIZE:
                if (file->f_mode & FMODE_WRITE) {

diff --git a/drivers/usb/class/bluetty.c b/drivers/usb/class/bluetty.c
index cbe2b782a25dfbcb4d01e2cc017a9da8defd6e08..093a80b9c154b6018986659a630cd7cc2ce8e4b5 100644 (file)
--- a/drivers/usb/class/bluetty.c
+++ b/drivers/usb/class/bluetty.c
@@ -490,7 +490,10 @@ static int bluetooth_write (struct tty_struct * tty, int from_user, const unsign
                        retval = -ENOMEM;
                        goto exit;
                }
-               copy_from_user (temp_buffer, buf, count);
+               if (copy_from_user (temp_buffer, buf, count)) {
+                       retval = -EFAULT;
+                       goto exit;
+               }
                current_buffer = temp_buffer;
        } else {
                current_buffer = buf;

diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index ad6a32776e8276e1d38de75199f292b7fc079091..3088e11055b5ddcb8cf38a9b5ebf7eb50ca2c54b 100644 (file)
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -367,9 +367,10 @@ static int acm_tty_write(struct tty_struct *tty, int from_user, const unsigned c
 
        count = (count > acm->writesize) ? acm->writesize : count;
 
-       if (from_user)
-               copy_from_user(acm->writeurb->transfer_buffer, buf, count);
-       else
+       if (from_user) {
+               if (copy_from_user(acm->writeurb->transfer_buffer, buf, count))
+                       return -EFAULT;
+       } else
                memcpy(acm->writeurb->transfer_buffer, buf, count);
 
        acm->writeurb->transfer_buffer_length = count;

diff --git a/drivers/usb/host/uhci-debug.c b/drivers/usb/host/uhci-debug.c
index abb0a56811e5f5a2ead9d2210370fc722e9d46ee..2c27eae0687bed7a351eea284989a8b834a96eb1 100644 (file)
--- a/drivers/usb/host/uhci-debug.c
+++ b/drivers/usb/host/uhci-debug.c
@@ -552,7 +552,8 @@ static ssize_t uhci_proc_read(struct file *file, char *buf, size_t nbytes,
        if (!access_ok(VERIFY_WRITE, buf, nbytes))
                return -EINVAL;
 
-       copy_to_user(buf, up->data + pos, nbytes);
+       if (copy_to_user(buf, up->data + pos, nbytes))
+               return -EFAULT;
 
        *ppos += nbytes;
 

diff --git a/drivers/usb/input/hiddev.c b/drivers/usb/input/hiddev.c
index 88f0d76c8c7a4bac01bf342fb19d1c55a52c7b9a..0e4347fa11e1172b7ef73d48e44dd48485d02804 100644 (file)
--- a/drivers/usb/input/hiddev.c
+++ b/drivers/usb/input/hiddev.c
@@ -389,7 +389,9 @@ static int hiddev_ioctl(struct inode *inode, struct file *file,
                dinfo.product = dev->descriptor.idProduct;
                dinfo.version = dev->descriptor.bcdDevice;
                dinfo.num_applications = hid->maxapplication;
-               return copy_to_user((void *) arg, &dinfo, sizeof(dinfo));
+               if (copy_to_user((void *) arg, &dinfo, sizeof(dinfo)))
+                       return -EFAULT;
+               return 0;
        }
 
        case HIDIOCGFLAG:
@@ -480,7 +482,9 @@ static int hiddev_ioctl(struct inode *inode, struct file *file,
 
                rinfo.num_fields = report->maxfield;
 
-               return copy_to_user((void *) arg, &rinfo, sizeof(rinfo));
+               if (copy_to_user((void *) arg, &rinfo, sizeof(rinfo)))
+                       return -EFAULT;
+               return 0;
 
        case HIDIOCGFIELDINFO:
        {
@@ -512,7 +516,9 @@ static int hiddev_ioctl(struct inode *inode, struct file *file,
                finfo.unit_exponent = field->unit_exponent;
                finfo.unit = field->unit;
 
-               return copy_to_user((void *) arg, &finfo, sizeof(finfo));
+               if (copy_to_user((void *) arg, &finfo, sizeof(finfo)))
+                       return -EFAULT;
+               return 0;
        }
 
        case HIDIOCGUCODE:
@@ -533,7 +539,9 @@ static int hiddev_ioctl(struct inode *inode, struct file *file,
 
                uref.usage_code = field->usage[uref.usage_index].hid;
 
-               return copy_to_user((void *) arg, &uref, sizeof(uref));
+               if (copy_to_user((void *) arg, &uref, sizeof(uref)))
+                       return -EFAULT;
+               return 0;
 
        case HIDIOCGUSAGE:
        case HIDIOCSUSAGE:
@@ -564,7 +572,9 @@ static int hiddev_ioctl(struct inode *inode, struct file *file,
 
                if (cmd == HIDIOCGUSAGE) {
                        uref.value = field->value[uref.usage_index];
-                       return copy_to_user((void *) arg, &uref, sizeof(uref));
+                       if (copy_to_user((void *) arg, &uref, sizeof(uref)))
+                               return -EFAULT;
+                       return 0;
                } else {
                        field->value[uref.usage_index] = uref.value;
                }

diff --git a/drivers/usb/media/dabusb.c b/drivers/usb/media/dabusb.c
index 0939bd74c2c8600184f983291d37c2b5fc1bfb6c..208337fa61e7c51e00b7a2d5bd807d23a860e91f 100644 (file)
--- a/drivers/usb/media/dabusb.c
+++ b/drivers/usb/media/dabusb.c
@@ -680,7 +680,9 @@ static int dabusb_ioctl (struct inode *inode, struct file *file, unsigned int cm
 
                ret=dabusb_bulk (s, pbulk);
                if(ret==0)
-                       ret = copy_to_user ((void *) arg, pbulk, sizeof (bulk_transfer_t));
+                       if (copy_to_user((void *)arg, pbulk,
+                                        sizeof(bulk_transfer_t)))
+                               ret = -EFAULT;
                kfree (pbulk);
                break;
 

diff --git a/drivers/usb/misc/auerswald.c b/drivers/usb/misc/auerswald.c
index 1a6f086298e601191f60348ff8bc86bdb9ffdf86..a77c19622b53ba04dfa5bcd413920994e18df6bd 100644 (file)
--- a/drivers/usb/misc/auerswald.c
+++ b/drivers/usb/misc/auerswald.c
@@ -1553,7 +1553,7 @@ static int auerchar_ioctl (struct inode *inode, struct file *file, unsigned int
                if (u > devinfo.bsize) {
                        u = devinfo.bsize;
                }
-               ret = copy_to_user(devinfo.buf, cp->dev_desc, u);
+               ret = copy_to_user(devinfo.buf, cp->dev_desc, u) ? -EFAULT : 0;
                break;
 
        /* get the max. string descriptor length */
@@ -1803,7 +1803,7 @@ write_again:
                wake_up (&cp->bufferwait);
                up (&cp->mutex);
                up (&ccp->mutex);
-               return -EIO;
+               return -EFAULT;
        }
 
        /* set the header byte */

diff --git a/drivers/usb/serial/ipaq.c b/drivers/usb/serial/ipaq.c
index 80847784cbcd9b6298ec81731c352faa602ca357..734d7bca750f99830af252f263783a0e420fa37a 100644 (file)
--- a/drivers/usb/serial/ipaq.c
+++ b/drivers/usb/serial/ipaq.c
@@ -353,7 +353,8 @@ static int ipaq_write_bulk(struct usb_serial_port *port, int from_user, const un
        }
 
        if (from_user) {
-               copy_from_user(pkt->data, buf, count);
+               if (copy_from_user(pkt->data, buf, count))
+                       return -EFAULT;
        } else {
                memcpy(pkt->data, buf, count);
        }

diff --git a/drivers/usb/serial/safe_serial.c b/drivers/usb/serial/safe_serial.c
index ca80dc61e7d12f5da7d785f907b3c5dbf17dc483..6e9acb5419c6b08b217b5b9dafa7cd7b57f85f55 100644 (file)
--- a/drivers/usb/serial/safe_serial.c
+++ b/drivers/usb/serial/safe_serial.c
@@ -319,7 +319,8 @@ static int safe_write (struct usb_serial_port *port, int from_user, const unsign
        memset (data, '0', packet_length);
 
        if (from_user) {
-               copy_from_user (data, buf, count);
+               if (copy_from_user (data, buf, count))
+                       return -EFAULT;
        } else {
                memcpy (data, buf, count);
        }