Prev: futex: FUTEX_LOCK with optional adaptive spinning
Next: linux-next: build failure after merge of the final tree (kvm tree related)
From: Stefan Richter on 7 Apr 2010 02:40
Stefan Richter wrote:
> --- a/drivers/firewire/core-cdev.c
> +++ b/drivers/firewire/core-cdev.c
> @@ -1346,41 +1346,43 @@ static int (* const ioctl_handlers[])(st
> static int dispatch_ioctl(struct client *client,
> unsigned int cmd, void __user *arg)
> {
> union ioctl_arg buffer;
> int ret;
>
> if (fw_device_is_shutdown(client->device))
> return -ENODEV;
>
> if (_IOC_TYPE(cmd) != '#' ||
> _IOC_NR(cmd) >= ARRAY_SIZE(ioctl_handlers))
> return -EINVAL;
>
> - if (_IOC_DIR(cmd) & _IOC_WRITE) {
> - if (_IOC_SIZE(cmd) > sizeof(buffer) ||
> - copy_from_user(&buffer, arg, _IOC_SIZE(cmd)))
> + if (_IOC_SIZE(cmd) > sizeof(buffer))
> + return -EFAULT;

I'll combine this into the preceding -EINVAL return. Cf. man ioctl.

> +
> + if (_IOC_DIR(cmd) == _IOC_READ)
> + memset(&buffer, 0, _IOC_SIZE(cmd));
> +
> + if (_IOC_DIR(cmd) & _IOC_WRITE)
> + if (copy_from_user(&buffer, arg, _IOC_SIZE(cmd)))
> return -EFAULT;
> - }
>
> ret = ioctl_handlers[_IOC_NR(cmd)](client, &buffer);
> if (ret < 0)
> return ret;
>
> - if (_IOC_DIR(cmd) & _IOC_READ) {
> - if (_IOC_SIZE(cmd) > sizeof(buffer) ||
> - copy_to_user(arg, &buffer, _IOC_SIZE(cmd)))
> + if (_IOC_DIR(cmd) & _IOC_READ)
> + if (copy_to_user(arg, &buffer, _IOC_SIZE(cmd)))
> return -EFAULT;
> - }
>
> return ret;
> }

--
Stefan Richter
-=====-==-=- -=-- --===
http://arcgraph.de/sr/
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo(a)vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
 | 
Pages: 1
Prev: futex: FUTEX_LOCK with optional adaptive spinning
Next: linux-next: build failure after merge of the final tree (kvm tree related)