From: Arnaldo Carvalho de Melo Date: Sun, 19 May 2002 00:56:44 +0000 (-0300) Subject: drivers/isdn/*.c X-Git-Tag: v2.5.17~30^2^2^2 X-Git-Url: http://git.neil.brown.name/?a=commitdiff_plain;h=7ccde684bf44fdf86ce54f0fb5814e54bb832f3a;p=history.git drivers/isdn/*.c - fix copy_{to,from}_user error handling (thanks to Rusty for pointing this out) --- diff --git a/drivers/isdn/act2000/module.c b/drivers/isdn/act2000/module.c index 3c9743862862..40953905b9c4 100644 --- a/drivers/isdn/act2000/module.c +++ b/drivers/isdn/act2000/module.c @@ -283,16 +283,18 @@ act2000_command(act2000_card * card, isdn_ctrl * c) actcapi_manufacturer_req_net(card); return 0; case ACT2000_IOCTL_SETMSN: - if ((ret = copy_from_user(tmp, (char *)a, sizeof(tmp)))) - return ret; + if (copy_from_user(tmp, (char *)a, + sizeof(tmp))) + return -EFAULT; if ((ret = act2000_set_msn(card, tmp))) return ret; if (card->flags & ACT2000_FLAGS_RUNNING) return(actcapi_manufacturer_req_msn(card)); return 0; case ACT2000_IOCTL_ADDCARD: - if ((ret = copy_from_user(&cdef, (char *)a, sizeof(cdef)))) - return ret; + if (copy_from_user(&cdef, (char *)a, + sizeof(cdef))) + return -EFAULT; if (act2000_addcard(cdef.bus, cdef.port, cdef.irq, cdef.id)) return -EIO; return 0; diff --git a/drivers/isdn/capi/capi.c b/drivers/isdn/capi/capi.c index 5a9534d8baeb..b9a46041aaa8 100644 --- a/drivers/isdn/capi/capi.c +++ b/drivers/isdn/capi/capi.c @@ -673,10 +673,9 @@ capi_read(struct file *file, char *buf, size_t count, loff_t *ppos) skb_queue_head(&cdev->recvqueue, skb); return -EMSGSIZE; } - retval = copy_to_user(buf, skb->data, skb->len); - if (retval) { + if (copy_to_user(buf, skb->data, skb->len)) { skb_queue_head(&cdev->recvqueue, skb); - return retval; + return -EFAULT; } copied = skb->len; @@ -703,7 +702,7 @@ capi_write(struct file *file, const char *buf, size_t count, loff_t *ppos) if (!skb) return -ENOMEM; - if ((retval = copy_from_user(skb_put(skb, count), buf, count))) { + if (copy_from_user(skb_put(skb, count), buf, count)) { kfree_skb(skb); return -EFAULT; } @@ -782,45 +781,36 @@ capi_ioctl(struct inode *inode, struct file *file, case CAPI_GET_VERSION: { - retval = copy_from_user((void *) &data.contr, + if (copy_from_user((void *) &data.contr, (void *) arg, - sizeof(data.contr)); - if (retval) + sizeof(data.contr))) return -EFAULT; cdev->errcode = capi20_get_version(data.contr, &data.version); if (cdev->errcode) return -EIO; - retval = copy_to_user((void *) arg, - (void *) &data.version, - sizeof(data.version)); - if (retval) + if (copy_to_user((void *)arg, (void *)&data.version, + sizeof(data.version))) return -EFAULT; } return 0; case CAPI_GET_SERIAL: { - retval = copy_from_user((void *) &data.contr, - (void *) arg, - sizeof(data.contr)); - if (retval) + if (copy_from_user((void *)&data.contr, (void *)arg, + sizeof(data.contr))) return -EFAULT; cdev->errcode = capi20_get_serial (data.contr, data.serial); if (cdev->errcode) return -EIO; - retval = copy_to_user((void *) arg, - (void *) data.serial, - sizeof(data.serial)); - if (retval) + if (copy_to_user((void *)arg, (void *)data.serial, + sizeof(data.serial))) return -EFAULT; } return 0; case CAPI_GET_PROFILE: { - retval = copy_from_user((void *) &data.contr, - (void *) arg, - sizeof(data.contr)); - if (retval) + if (copy_from_user((void *)&data.contr, (void *)arg, + sizeof(data.contr))) return -EFAULT; if (data.contr == 0) { @@ -848,18 +838,15 @@ capi_ioctl(struct inode *inode, struct file *file, case CAPI_GET_MANUFACTURER: { - retval = copy_from_user((void *) &data.contr, - (void *) arg, - sizeof(data.contr)); - if (retval) + if (copy_from_user((void *)&data.contr, (void *)arg, + sizeof(data.contr))) return -EFAULT; cdev->errcode = capi20_get_manufacturer(data.contr, data.manufacturer); if (cdev->errcode) return -EIO; - retval = copy_to_user((void *) arg, (void *) data.manufacturer, - sizeof(data.manufacturer)); - if (retval) + if (copy_to_user((void *)arg, (void *)data.manufacturer, + sizeof(data.manufacturer))) return -EFAULT; } @@ -868,10 +855,8 @@ capi_ioctl(struct inode *inode, struct file *file, data.errcode = cdev->errcode; cdev->errcode = CAPI_NOERROR; if (arg) { - retval = copy_to_user((void *) arg, - (void *) &data.errcode, - sizeof(data.errcode)); - if (retval) + if (copy_to_user((void *)arg, (void *)&data.errcode, + sizeof(data.errcode))) return -EFAULT; } return data.errcode; @@ -886,9 +871,8 @@ capi_ioctl(struct inode *inode, struct file *file, struct capi_manufacturer_cmd mcmd; if (!capable(CAP_SYS_ADMIN)) return -EPERM; - retval = copy_from_user((void *) &mcmd, (void *) arg, - sizeof(mcmd)); - if (retval) + if (copy_from_user((void *)&mcmd, (void *)arg, + sizeof(mcmd))) return -EFAULT; return capi20_manufacturer(mcmd.cmd, mcmd.data); } @@ -898,10 +882,8 @@ capi_ioctl(struct inode *inode, struct file *file, case CAPI_CLR_FLAGS: { unsigned userflags; - retval = copy_from_user((void *) &userflags, - (void *) arg, - sizeof(userflags)); - if (retval) + if (copy_from_user((void *)&userflags, (void *)arg, + sizeof(userflags))) return -EFAULT; if (cmd == CAPI_SET_FLAGS) cdev->userflags |= userflags; @@ -911,13 +893,9 @@ capi_ioctl(struct inode *inode, struct file *file, return 0; case CAPI_GET_FLAGS: - { - retval = copy_to_user((void *) arg, - (void *) &cdev->userflags, - sizeof(cdev->userflags)); - if (retval) - return -EFAULT; - } + if (copy_to_user((void *)arg, (void *)&cdev->userflags, + sizeof(cdev->userflags))) + return -EFAULT; return 0; case CAPI_NCCI_OPENCOUNT: @@ -928,10 +906,8 @@ capi_ioctl(struct inode *inode, struct file *file, #endif /* CONFIG_ISDN_CAPI_MIDDLEWARE */ unsigned ncci; int count = 0; - retval = copy_from_user((void *) &ncci, - (void *) arg, - sizeof(ncci)); - if (retval) + if (copy_from_user((void *)&ncci, (void *)arg, + sizeof(ncci))) return -EFAULT; nccip = capincci_find(cdev, (u32) ncci); if (!nccip) @@ -951,10 +927,8 @@ capi_ioctl(struct inode *inode, struct file *file, struct capincci *nccip; struct capiminor *mp; unsigned ncci; - retval = copy_from_user((void *) &ncci, - (void *) arg, - sizeof(ncci)); - if (retval) + if (copy_from_user((void *)&ncci, (void *)arg, + sizeof(ncci))) return -EFAULT; nccip = capincci_find(cdev, (u32) ncci); if (!nccip || (mp = nccip->minorp) == 0) diff --git a/drivers/isdn/capi/kcapi.c b/drivers/isdn/capi/kcapi.c index b3ce4372649c..a609563d7c84 100644 --- a/drivers/isdn/capi/kcapi.c +++ b/drivers/isdn/capi/kcapi.c @@ -1060,15 +1060,15 @@ static int old_capi_manufacturer(unsigned int cmd, void *data) case AVMB1_LOAD_AND_CONFIG: if (cmd == AVMB1_LOAD) { - if ((retval = copy_from_user((void *) &ldef, data, - sizeof(avmb1_loaddef)))) - return retval; + if (copy_from_user((void *)&ldef, data, + sizeof(avmb1_loaddef))) + return -EFAULT; ldef.t4config.len = 0; ldef.t4config.data = 0; } else { - if ((retval = copy_from_user((void *) &ldef, data, - sizeof(avmb1_loadandconfigdef)))) - return retval; + if (copy_from_user((void *)&ldef, data, + sizeof(avmb1_loadandconfigdef))) + return -EFAULT; } card = get_capi_ctr_by_nr(ldef.contr); card = capi_ctr_get(card); @@ -1123,9 +1123,8 @@ static int old_capi_manufacturer(unsigned int cmd, void *data) return 0; case AVMB1_RESETCARD: - if ((retval = copy_from_user((void *) &rdef, data, - sizeof(avmb1_resetdef)))) - return retval; + if (copy_from_user((void *)&rdef, data, sizeof(avmb1_resetdef))) + return -EFAULT; card = get_capi_ctr_by_nr(rdef.contr); if (!card) return -ESRCH; @@ -1146,9 +1145,8 @@ static int old_capi_manufacturer(unsigned int cmd, void *data) return 0; case AVMB1_GET_CARDINFO: - if ((retval = copy_from_user((void *) &gdef, data, - sizeof(avmb1_getdef)))) - return retval; + if (copy_from_user((void *)&gdef, data, sizeof(avmb1_getdef))) + return -EFAULT; card = get_capi_ctr_by_nr(gdef.contr); if (!card) @@ -1159,9 +1157,8 @@ static int old_capi_manufacturer(unsigned int cmd, void *data) gdef.cardtype = AVM_CARDTYPE_T1; else gdef.cardtype = AVM_CARDTYPE_B1; - if ((retval = copy_to_user(data, (void *) &gdef, - sizeof(avmb1_getdef)))) - return retval; + if (copy_to_user(data, (void *)&gdef, sizeof(avmb1_getdef))) + return -EFAULT; return 0; } @@ -1187,9 +1184,8 @@ int capi20_manufacturer(unsigned int cmd, void *data) { kcapi_flagdef fdef; - if ((retval = copy_from_user((void *) &fdef, data, - sizeof(kcapi_flagdef)))) - return retval; + if (copy_from_user((void *)&fdef, data, sizeof(kcapi_flagdef))) + return -EFAULT; card = get_capi_ctr_by_nr(fdef.contr); if (!card) diff --git a/drivers/isdn/divert/divert_procfs.c b/drivers/isdn/divert/divert_procfs.c index 556223f4e080..a1845162fd4c 100644 --- a/drivers/isdn/divert/divert_procfs.c +++ b/drivers/isdn/divert/divert_procfs.c @@ -185,8 +185,8 @@ isdn_divert_ioctl(struct inode *inode, struct file *file, divert_rule *rulep; char *cp; - if ((i = copy_from_user(&dioctl, (char *) arg, sizeof(dioctl)))) - return (i); + if (copy_from_user(&dioctl, (char *) arg, sizeof(dioctl))) + return -EFAULT; switch (cmd) { case IIOCGETVER: @@ -254,7 +254,7 @@ isdn_divert_ioctl(struct inode *inode, struct file *file, default: return (-EINVAL); } /* switch cmd */ - return (copy_to_user((char *) arg, &dioctl, sizeof(dioctl))); /* success */ + return copy_to_user((char *)arg, &dioctl, sizeof(dioctl)) ? -EFAULT : 0; } /* isdn_divert_ioctl */ diff --git a/drivers/isdn/eicon/eicon_mod.c b/drivers/isdn/eicon/eicon_mod.c index 6f1bbbedad19..f51cffef1d6a 100644 --- a/drivers/isdn/eicon/eicon_mod.c +++ b/drivers/isdn/eicon/eicon_mod.c @@ -213,7 +213,10 @@ eicon_command(eicon_card * card, isdn_ctrl * c) return(EICON_CTRL_VERSION); case EICON_IOCTL_GETTYPE: if (card->bus == EICON_BUS_PCI) { - copy_to_user((char *)a, &card->hwif.pci.master, sizeof(int)); + if (copy_to_user((char *)a, + &card->hwif.pci.master, + sizeof(int))) + return -EFAULT; } return(card->type); case EICON_IOCTL_GETMMIO: @@ -351,7 +354,8 @@ eicon_command(eicon_card * card, isdn_ctrl * c) return -ENODEV; case EICON_IOCTL_ADDCARD: - if ((ret = copy_from_user(&cdef, (char *)a, sizeof(cdef)))) + if (copy_from_user(&cdef, (char *)a, + sizeof(cdef))) return -EFAULT; if (!(eicon_addcard(0, cdef.membase, cdef.irq, cdef.id, 0))) return -EIO; @@ -376,8 +380,9 @@ eicon_command(eicon_card * card, isdn_ctrl * c) #ifdef CONFIG_ISDN_DRV_EICON_PCI if (c->arg < EICON_IOCTL_DIA_OFFSET) return -EINVAL; - if (copy_from_user(&dstart, (char *)a, sizeof(dstart))) - return -1; + if (copy_from_user(&dstart, (char *)a, + sizeof(dstart))) + return -EFAULT; if (!(card = eicon_findnpcicard(dstart.card_id))) return -EINVAL; ret = do_ioctl(NULL, NULL, @@ -667,7 +672,8 @@ if_readstatus(u_char * buf, int len, int user, int id, int channel) if (user) { spin_unlock_irqrestore(&eicon_lock, flags); - copy_to_user(p, skb->data, cnt); + if (copy_to_user(p, skb->data, cnt)) + return -EFAULT; spin_lock_irqsave(&eicon_lock, flags); } else diff --git a/drivers/isdn/hardware/avm/b1.c b/drivers/isdn/hardware/avm/b1.c index d44b7fe37ff1..8f902c468972 100644 --- a/drivers/isdn/hardware/avm/b1.c +++ b/drivers/isdn/hardware/avm/b1.c @@ -166,15 +166,14 @@ int b1_load_t4file(avmcard *card, capiloaddatapart * t4file) { unsigned char buf[256]; unsigned char *dp; - int i, left, retval; + int i, left; unsigned int base = card->port; dp = t4file->data; left = t4file->len; while (left > sizeof(buf)) { if (t4file->user) { - retval = copy_from_user(buf, dp, sizeof(buf)); - if (retval) + if (copy_from_user(buf, dp, sizeof(buf))) return -EFAULT; } else { memcpy(buf, dp, sizeof(buf)); @@ -190,8 +189,7 @@ int b1_load_t4file(avmcard *card, capiloaddatapart * t4file) } if (left) { if (t4file->user) { - retval = copy_from_user(buf, dp, left); - if (retval) + if (copy_from_user(buf, dp, left)) return -EFAULT; } else { memcpy(buf, dp, left); @@ -211,7 +209,7 @@ int b1_load_config(avmcard *card, capiloaddatapart * config) unsigned char buf[256]; unsigned char *dp; unsigned int base = card->port; - int i, j, left, retval; + int i, j, left; dp = config->data; left = config->len; @@ -223,8 +221,7 @@ int b1_load_config(avmcard *card, capiloaddatapart * config) } while (left > sizeof(buf)) { if (config->user) { - retval = copy_from_user(buf, dp, sizeof(buf)); - if (retval) + if (copy_from_user(buf, dp, sizeof(buf))) return -EFAULT; } else { memcpy(buf, dp, sizeof(buf)); @@ -240,8 +237,7 @@ int b1_load_config(avmcard *card, capiloaddatapart * config) } if (left) { if (config->user) { - retval = copy_from_user(buf, dp, left); - if (retval) + if (copy_from_user(buf, dp, left)) return -EFAULT; } else { memcpy(buf, dp, left); diff --git a/drivers/isdn/hardware/avm/c4.c b/drivers/isdn/hardware/avm/c4.c index 731d06060739..5972a801c1f2 100644 --- a/drivers/isdn/hardware/avm/c4.c +++ b/drivers/isdn/hardware/avm/c4.c @@ -191,15 +191,14 @@ static int c4_load_t4file(avmcard *card, capiloaddatapart * t4file) { u32 val; unsigned char *dp; - int left, retval; + int left; u32 loadoff = 0; dp = t4file->data; left = t4file->len; while (left >= sizeof(u32)) { if (t4file->user) { - retval = copy_from_user(&val, dp, sizeof(val)); - if (retval) + if (copy_from_user(&val, dp, sizeof(val))) return -EFAULT; } else { memcpy(&val, dp, sizeof(val)); @@ -216,8 +215,7 @@ static int c4_load_t4file(avmcard *card, capiloaddatapart * t4file) if (left) { val = 0; if (t4file->user) { - retval = copy_from_user(&val, dp, left); - if (retval) + if (copy_from_user(&val, dp, left)) return -EFAULT; } else { memcpy(&val, dp, left); @@ -808,8 +806,7 @@ static int c4_send_config(avmcard *card, capiloaddatapart * config) left = config->len; while (left >= sizeof(u32)) { if (config->user) { - retval = copy_from_user(val, dp, sizeof(val)); - if (retval) + if (copy_from_user(val, dp, sizeof(val))) return -EFAULT; } else { memcpy(val, dp, sizeof(val)); @@ -822,8 +819,7 @@ static int c4_send_config(avmcard *card, capiloaddatapart * config) if (left) { memset(val, 0, sizeof(val)); if (config->user) { - retval = copy_from_user(&val, dp, left); - if (retval) + if (copy_from_user(&val, dp, left)) return -EFAULT; } else { memcpy(&val, dp, left); diff --git a/drivers/isdn/hisax/config.c b/drivers/isdn/hisax/config.c index 25280172bb1b..8570c79868cc 100644 --- a/drivers/isdn/hisax/config.c +++ b/drivers/isdn/hisax/config.c @@ -641,9 +641,10 @@ int HiSax_readstatus(u_char * buf, int len, int user, int id, int channel) count = cs->status_end - cs->status_read + 1; if (count >= len) count = len; - if (user) - copy_to_user(p, cs->status_read, count); - else + if (user) { + if (copy_to_user(p, cs->status_read, count)) + return -EFAULT; + } else memcpy(p, cs->status_read, count); cs->status_read += count; if (cs->status_read > cs->status_end) @@ -655,9 +656,10 @@ int HiSax_readstatus(u_char * buf, int len, int user, int id, int channel) cnt = HISAX_STATUS_BUFSIZE; else cnt = count; - if (user) - copy_to_user(p, cs->status_read, cnt); - else + if (user) { + if (copy_to_user(p, cs->status_read, cnt)) + return -EFAULT; + } else memcpy(p, cs->status_read, cnt); p += cnt; cs->status_read += cnt % HISAX_STATUS_BUFSIZE; diff --git a/drivers/isdn/hisax/isar.c b/drivers/isdn/hisax/isar.c index 766428ed9e9d..322184c790c9 100644 --- a/drivers/isdn/hisax/isar.c +++ b/drivers/isdn/hisax/isar.c @@ -217,7 +217,7 @@ isar_load_firmware(struct IsdnCardState *cs, u_char *buf) } if ((ret = copy_from_user(&size, p, sizeof(int)))) { printk(KERN_ERR"isar_load_firmware copy_from_user ret %d\n", ret); - return ret; + return -EFAULT; } p += sizeof(int); printk(KERN_DEBUG"isar_load_firmware size: %d\n", size); @@ -240,6 +240,7 @@ isar_load_firmware(struct IsdnCardState *cs, u_char *buf) while (cnt < size) { if ((ret = copy_from_user(&blk_head, p, BLK_HEAD_SIZE))) { printk(KERN_ERR"isar_load_firmware copy_from_user ret %d\n", ret); + ret = -EFAULT; goto reterror; } #ifdef __BIG_ENDIAN @@ -282,6 +283,7 @@ isar_load_firmware(struct IsdnCardState *cs, u_char *buf) *mp++ = noc; if ((ret = copy_from_user(tmpmsg, p, nom))) { printk(KERN_ERR"isar_load_firmware copy_from_user ret %d\n", ret); + ret = -EFAULT; goto reterror; } p += nom; diff --git a/drivers/isdn/i4l/isdn_ppp.c b/drivers/isdn/i4l/isdn_ppp.c index 95d9f72a4f5e..622b69cadcd7 100644 --- a/drivers/isdn/i4l/isdn_ppp.c +++ b/drivers/isdn/i4l/isdn_ppp.c @@ -731,7 +731,11 @@ isdn_ppp_read(struct file *file, char *buf, size_t count, loff_t *off) restore_flags(flags); - copy_to_user(buf, save_buf, count); + if (copy_to_user(buf, save_buf, count)) { + kfree(save_buf); + retval = -EFAULT; + goto out; + } kfree(save_buf); retval = count; diff --git a/drivers/isdn/i4l/isdn_tty.c b/drivers/isdn/i4l/isdn_tty.c index 0cb479b9e662..18508e46a8b5 100644 --- a/drivers/isdn/i4l/isdn_tty.c +++ b/drivers/isdn/i4l/isdn_tty.c @@ -1202,9 +1202,12 @@ isdn_tty_write(struct tty_struct *tty, int from_user, const u_char * buf, int co &(m->pluscount), &(m->lastplus), from_user); - if (from_user) - copy_from_user(&(info->xmit_buf[info->xmit_count]), buf, c); - else + if (from_user) { + if (copy_from_user(&(info->xmit_buf[info->xmit_count]), buf, c)) { + total = -EFAULT; + goto out; + } + } else memcpy(&(info->xmit_buf[info->xmit_count]), buf, c); #ifdef CONFIG_ISDN_AUDIO if (info->vonline) { @@ -1284,6 +1287,7 @@ isdn_tty_write(struct tty_struct *tty, int from_user, const u_char * buf, int co } isdn_timer_ctrl(ISDN_TIMER_MODEMXMIT, 1); } +out: if (from_user) up(&info->write_sem); return total; @@ -2589,7 +2593,8 @@ isdn_tty_check_esc(const u_char * p, u_char plus, int count, int *pluscount, *pluscount = 0; } if (from_user) { - copy_from_user(cbuf, p, count); + if (copy_from_user(cbuf, p, count)) + return; p = cbuf; } while (count > 0) { diff --git a/drivers/isdn/icn/icn.c b/drivers/isdn/icn/icn.c index 22061b2f6925..d6c3de6fcc6f 100644 --- a/drivers/isdn/icn/icn.c +++ b/drivers/isdn/icn/icn.c @@ -821,9 +821,9 @@ icn_loadboot(u_char * buffer, icn_card * card) printk(KERN_WARNING "icn: Could not allocate code buffer\n"); return -ENOMEM; } - if ((ret = copy_from_user(codebuf, buffer, ICN_CODE_STAGE1))) { + if (copy_from_user(codebuf, buffer, ICN_CODE_STAGE1)) { kfree(codebuf); - return ret; + return -EFAULT; } if (!card->rvalid) { if (check_region(card->port, ICN_PORTLEN)) { @@ -1057,9 +1057,10 @@ icn_writecmd(const u_char * buf, int len, int user, icn_card * card) count = cmd_free; if (count > len) count = len; - if (user) - copy_from_user(msg, buf, count); - else + if (user) { + if (copy_from_user(msg, buf, count)) + return -EFAULT; + } else memcpy(msg, buf, count); save_flags(flags); @@ -1237,15 +1238,17 @@ icn_command(isdn_ctrl * c, icn_card * card) case ICN_IOCTL_GETDOUBLE: return (int) card->doubleS0; case ICN_IOCTL_DEBUGVAR: - if ((i = copy_to_user((char *) a, - (char *) &card, sizeof(ulong)))) - return i; + if (copy_to_user((char *)a, + (char *)&card, + sizeof(ulong))) + return -EFAULT; a += sizeof(ulong); { ulong l = (ulong) & dev; - if ((i = copy_to_user((char *) a, - (char *) &l, sizeof(ulong)))) - return i; + if (copy_to_user((char *)a, + (char *)&l, + sizeof(ulong))) + return -EFAULT; } return 0; case ICN_IOCTL_LOADBOOT: @@ -1266,8 +1269,10 @@ icn_command(isdn_ctrl * c, icn_card * card) case ICN_IOCTL_ADDCARD: if (!dev.firstload) return -EBUSY; - if ((i = copy_from_user((char *) &cdef, (char *) a, sizeof(cdef)))) - return i; + if (copy_from_user((char *)&cdef, + (char *)a, + sizeof(cdef))) + return -EFAULT; return (icn_addcard(cdef.port, cdef.id1, cdef.id2)); break; case ICN_IOCTL_LEASEDCFG: diff --git a/drivers/isdn/isdnloop/isdnloop.c b/drivers/isdn/isdnloop/isdnloop.c index c551abfed701..3fab06149f0c 100644 --- a/drivers/isdn/isdnloop/isdnloop.c +++ b/drivers/isdn/isdnloop/isdnloop.c @@ -986,9 +986,10 @@ isdnloop_writecmd(const u_char * buf, int len, int user, isdnloop_card * card) if (count > 255) count = 255; - if (user) - copy_from_user(msg, buf, count); - else + if (user) { + if (copy_from_user(msg, buf, count)) + return -EFAULT; + } else memcpy(msg, buf, count); isdnloop_putmsg(card, '>'); for (p = msg; count > 0; count--, p++) { @@ -1076,7 +1077,8 @@ isdnloop_start(isdnloop_card * card, isdnloop_sdef * sdefp) if (card->flags & ISDNLOOP_FLAGS_RUNNING) return -EBUSY; - copy_from_user((char *) &sdef, (char *) sdefp, sizeof(sdef)); + if (copy_from_user((char *) &sdef, (char *) sdefp, sizeof(sdef))) + return -EFAULT; save_flags(flags); cli(); switch (sdef.ptype) { @@ -1149,9 +1151,10 @@ isdnloop_command(isdn_ctrl * c, isdnloop_card * card) return (isdnloop_start(card, (isdnloop_sdef *) a)); break; case ISDNLOOP_IOCTL_ADDCARD: - if ((i = verify_area(VERIFY_READ, (void *) a, sizeof(isdnloop_cdef)))) - return i; - copy_from_user((char *) &cdef, (char *) a, sizeof(cdef)); + if (copy_from_user((char *)&cdef, + (char *)a, + sizeof(cdef))) + return -EFAULT; return (isdnloop_addcard(cdef.id1)); break; case ISDNLOOP_IOCTL_LEASEDCFG: diff --git a/drivers/isdn/sc/command.c b/drivers/isdn/sc/command.c index 6825512a43d5..fd62630b5df8 100644 --- a/drivers/isdn/sc/command.c +++ b/drivers/isdn/sc/command.c @@ -126,11 +126,11 @@ int command(isdn_ctrl *cmd) int err; memcpy(&cmdptr, cmd->parm.num, sizeof(unsigned long)); - if((err = copy_from_user(&ioc, (scs_ioctl *) cmdptr, - sizeof(scs_ioctl)))) { + if (copy_from_user(&ioc, (scs_ioctl *)cmdptr, + sizeof(scs_ioctl))) { pr_debug("%s: Failed to verify user space 0x%x\n", adapter[card]->devicename, cmdptr); - return err; + return -EFAULT; } return sc_ioctl(card, &ioc); } diff --git a/drivers/isdn/sc/ioctl.c b/drivers/isdn/sc/ioctl.c index 807d85d36c69..2bc131a4ba29 100644 --- a/drivers/isdn/sc/ioctl.c +++ b/drivers/isdn/sc/ioctl.c @@ -55,8 +55,8 @@ int sc_ioctl(int card, scs_ioctl *data) /* * Get the SRec from user space */ - if ((err = copy_from_user(srec, (char *) data->dataptr, sizeof(srec)))) - return err; + if (copy_from_user(srec, (char *) data->dataptr, sizeof(srec))) + return -EFAULT; status = send_and_receive(card, CMPID, cmReqType2, cmReqClass0, cmReqLoadProc, 0, sizeof(srec), srec, &rcvmsg, SAR_TIMEOUT); @@ -96,8 +96,9 @@ int sc_ioctl(int card, scs_ioctl *data) /* * Get the switch type from user space */ - if ((err = copy_from_user(&switchtype, (char *) data->dataptr, sizeof(char)))) - return err; + if (copy_from_user(&switchtype, (char *)data->dataptr, + sizeof(char))) + return -EFAULT; pr_debug("%s: SCIOCSETSWITCH: setting switch type to %d\n", adapter[card]->devicename, switchtype); @@ -141,8 +142,9 @@ int sc_ioctl(int card, scs_ioctl *data) /* * Package the switch type and send to user space */ - if ((err = copy_to_user((char *) data->dataptr, &switchtype, sizeof(char)))) - return err; + if (copy_to_user((char *)data->dataptr, &switchtype, + sizeof(char))) + return -EFAULT; return 0; } @@ -173,8 +175,8 @@ int sc_ioctl(int card, scs_ioctl *data) /* * Package the switch type and send to user space */ - if ((err = copy_to_user((char *) data->dataptr, spid, sizeof(spid)))) - return err; + if (copy_to_user((char *)data->dataptr, spid, sizeof(spid))) + return -EFAULT; return 0; } @@ -190,8 +192,8 @@ int sc_ioctl(int card, scs_ioctl *data) /* * Get the spid from user space */ - if ((err = copy_from_user(spid, (char *) data->dataptr, sizeof(spid)))) - return err; + if (copy_from_user(spid, (char *) data->dataptr, sizeof(spid))) + return -EFAULT; pr_debug("%s: SCIOCSETSPID: setting channel %d spid to %s\n", adapter[card]->devicename, data->channel, spid); @@ -237,8 +239,8 @@ int sc_ioctl(int card, scs_ioctl *data) /* * Package the dn and send to user space */ - if ((err = copy_to_user((char *) data->dataptr, dn, sizeof(dn)))) - return err; + if (copy_to_user((char *)data->dataptr, dn, sizeof(dn))) + return -EFAULT; return 0; } @@ -254,8 +256,8 @@ int sc_ioctl(int card, scs_ioctl *data) /* * Get the spid from user space */ - if ((err = copy_from_user(dn, (char *) data->dataptr, sizeof(dn)))) - return err; + if (copy_from_user(dn, (char *)data->dataptr, sizeof(dn))) + return -EFAULT; pr_debug("%s: SCIOCSETDN: setting channel %d dn to %s\n", adapter[card]->devicename, data->channel, dn); @@ -290,8 +292,9 @@ int sc_ioctl(int card, scs_ioctl *data) pr_debug("%s: SCIOSTAT: ioctl received\n", adapter[card]->devicename); GetStatus(card, &bi); - if ((err = copy_to_user((boardInfo *) data->dataptr, &bi, sizeof(boardInfo)))) - return err; + if (copy_to_user((boardInfo *)data->dataptr, &bi, + sizeof(boardInfo))) + return -EFAULT; return 0; } @@ -324,8 +327,8 @@ int sc_ioctl(int card, scs_ioctl *data) /* * Package the switch type and send to user space */ - if ((err = copy_to_user((char *) data->dataptr, &speed, sizeof(char)))) - return err; + if (copy_to_user((char *) data->dataptr, &speed, sizeof(char))) + return -EFAULT; return 0; } diff --git a/drivers/isdn/tpam/tpam_commands.c b/drivers/isdn/tpam/tpam_commands.c index ca83345c3860..eb7e6eb8b8a2 100644 --- a/drivers/isdn/tpam/tpam_commands.c +++ b/drivers/isdn/tpam/tpam_commands.c @@ -126,7 +126,6 @@ int tpam_command(isdn_ctrl *c) { */ static int tpam_command_ioctl_dspload(tpam_card *card, u32 arg) { tpam_dsp_ioctl tdl; - int ret; dprintk("TurboPAM(tpam_command_ioctl_dspload): card=%d\n", card->id); @@ -141,10 +140,9 @@ static int tpam_command_ioctl_dspload(tpam_card *card, u32 arg) { return -EPERM; /* write the data in the board's memory */ - ret = copy_from_user_to_pam(card, (void *)tdl.address, - (void *)arg + sizeof(tpam_dsp_ioctl), - tdl.data_len); - return 0; + return copy_from_user_to_pam(card, (void *)tdl.address, + (void *)arg + sizeof(tpam_dsp_ioctl), + tdl.data_len); } /* @@ -158,7 +156,6 @@ static int tpam_command_ioctl_dspload(tpam_card *card, u32 arg) { */ static int tpam_command_ioctl_dspsave(tpam_card *card, u32 arg) { tpam_dsp_ioctl tdl; - int ret; dprintk("TurboPAM(tpam_command_ioctl_dspsave): card=%d\n", card->id); @@ -171,9 +168,8 @@ static int tpam_command_ioctl_dspsave(tpam_card *card, u32 arg) { return -EPERM; /* read the data from the board's memory */ - ret = copy_from_pam_to_user(card, (void *)arg + sizeof(tpam_dsp_ioctl), - (void *)tdl.address, tdl.data_len); - return ret; + return copy_from_pam_to_user(card, (void *)arg + sizeof(tpam_dsp_ioctl), + (void *)tdl.address, tdl.data_len); } /*