[PATCH] sparse: blind dereference of userland pointers in divasproc

1 files changed, 21 insertions, 8 deletions

diff --git a/drivers/isdn/hardware/eicon/divasproc.c b/drivers/isdn/hardware/eicon/divasproc.c
index abf80d82e704..192fae4c6465 100644
--- a/drivers/isdn/hardware/eicon/divasproc.c
+++ b/drivers/isdn/hardware/eicon/divasproc.c
@@ -54,7 +54,7 @@ extern struct proc_dir_entry *proc_net_eicon;
 static struct proc_dir_entry *divas_proc_entry = NULL;
 
 static ssize_t
-divas_read(struct file *file, char *buf, size_t count, loff_t * off)
+divas_read(struct file *file, char __user *buf, size_t count, loff_t * off)
 {
 	int len = 0;
 	int cadapter;
@@ -95,7 +95,7 @@ divas_read(struct file *file, char *buf, size_t count, loff_t * off)
 }
 
 static ssize_t
-divas_write(struct file *file, const char *buf, size_t count, loff_t * off)
+divas_write(struct file *file, const char __user *buf, size_t count, loff_t * off)
 {
 	return (-ENODEV);
 }
@@ -151,14 +151,17 @@ void remove_divas_proc(void)
 ** write group_optimization 
 */
 static int
-write_grp_opt(struct file *file, const char *buffer, unsigned long count,
+write_grp_opt(struct file *file, const char __user *buffer, unsigned long count,
 	      void *data)
 {
 	diva_os_xdi_adapter_t *a = (diva_os_xdi_adapter_t *) data;
 	PISDN_ADAPTER IoAdapter = IoAdapters[a->controller - 1];
 
 	if ((count == 1) || (count == 2)) {
-		switch (buffer[0]) {
+		char c;
+		if (get_user(c, buffer))
+			return -EFAULT;
+		switch (c) {
 		case '0':
 			IoAdapter->capi_cfg.cfg_1 &=
 			    ~DIVA_XDI_CAPI_CFG_1_GROUP_POPTIMIZATION_ON;
@@ -179,14 +182,17 @@ write_grp_opt(struct file *file, const char *buffer, unsigned long count,
 ** write dynamic_l1_down
 */
 static int
-write_d_l1_down(struct file *file, const char *buffer, unsigned long count,
+write_d_l1_down(struct file *file, const char __user *buffer, unsigned long count,
 		void *data)
 {
 	diva_os_xdi_adapter_t *a = (diva_os_xdi_adapter_t *) data;
 	PISDN_ADAPTER IoAdapter = IoAdapters[a->controller - 1];
 
 	if ((count == 1) || (count == 2)) {
-		switch (buffer[0]) {
+		char c;
+		if (get_user(c, buffer))
+			return -EFAULT;
+		switch (c) {
 		case '0':
 			IoAdapter->capi_cfg.cfg_1 &=
 			    ~DIVA_XDI_CAPI_CFG_1_DYNAMIC_L1_ON;
@@ -256,14 +262,21 @@ read_grp_opt(char *page, char **start, off_t off, int count, int *eof,
 ** info write
 */
 static int
-info_write(struct file *file, const char *buffer, unsigned long count,
+info_write(struct file *file, const char __user *buffer, unsigned long count,
 	   void *data)
 {
 	diva_os_xdi_adapter_t *a = (diva_os_xdi_adapter_t *) data;
 	PISDN_ADAPTER IoAdapter = IoAdapters[a->controller - 1];
+	char c[4];
+
+	if (count <= 4)
+		return -EINVAL;
+
+	if (copy_from_user(c, buffer, 4))
+		return -EFAULT;
 
 	/* this is for test purposes only */
-	if ((count > 4) && (!memcmp(buffer, "trap", 4))) {
+	if (!memcmp(c, "trap", 4)) {
 		(*(IoAdapter->os_trap_nfy_Fnc)) (IoAdapter, IoAdapter->ANum);
 		return (count);
 	}