diff options
| author | Arnaldo Carvalho de Melo <acme@conectiva.com.br> | 2002-05-18 22:25:13 -0300 |
|---|---|---|
| committer | Linus Torvalds <torvalds@home.transmeta.com> | 2002-05-18 22:25:13 -0300 |
| commit | a465121e2b8a3e2cdb2aa39ab35d5a5131230265 (patch) | |
| tree | a5e81c2be8ad87d846abfb4a84369428e340d6a2 /drivers/usb/class | |
| parent | 291884c98ae119a91d8afe0131019c66e3d6fbc7 (diff) | |
drivers/usr/*.c
- fix copy_{to,from}_user error handling (thanks to Rusty for pointing this out)
Diffstat (limited to 'drivers/usb/class')
| -rw-r--r-- | drivers/usb/class/audio.c | 8 | ||||
| -rw-r--r-- | drivers/usb/class/bluetty.c | 5 | ||||
| -rw-r--r-- | drivers/usb/class/cdc-acm.c | 7 |
3 files changed, 14 insertions, 6 deletions
diff --git a/drivers/usb/class/audio.c b/drivers/usb/class/audio.c index b02a3aee8489..f04db26a2fa0 100644 --- a/drivers/usb/class/audio.c +++ b/drivers/usb/class/audio.c @@ -2542,7 +2542,9 @@ static int usb_audio_ioctl(struct inode *inode, struct file *file, unsigned int if (as->usbin.dma.mapped) as->usbin.dma.count &= as->usbin.dma.fragsize-1; spin_unlock_irqrestore(&as->lock, flags); - return copy_to_user((void *)arg, &cinfo, sizeof(cinfo)); + if (copy_to_user((void *)arg, &cinfo, sizeof(cinfo))) + return -EFAULT; + return 0; case SNDCTL_DSP_GETOPTR: if (!(file->f_mode & FMODE_WRITE)) @@ -2554,7 +2556,9 @@ static int usb_audio_ioctl(struct inode *inode, struct file *file, unsigned int if (as->usbout.dma.mapped) as->usbout.dma.count &= as->usbout.dma.fragsize-1; spin_unlock_irqrestore(&as->lock, flags); - return copy_to_user((void *)arg, &cinfo, sizeof(cinfo)); + if (copy_to_user((void *)arg, &cinfo, sizeof(cinfo))) + return -EFAULT; + return 0; case SNDCTL_DSP_GETBLKSIZE: if (file->f_mode & FMODE_WRITE) { diff --git a/drivers/usb/class/bluetty.c b/drivers/usb/class/bluetty.c index cbe2b782a25d..093a80b9c154 100644 --- a/drivers/usb/class/bluetty.c +++ b/drivers/usb/class/bluetty.c @@ -490,7 +490,10 @@ static int bluetooth_write (struct tty_struct * tty, int from_user, const unsign retval = -ENOMEM; goto exit; } - copy_from_user (temp_buffer, buf, count); + if (copy_from_user (temp_buffer, buf, count)) { + retval = -EFAULT; + goto exit; + } current_buffer = temp_buffer; } else { current_buffer = buf; diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c index ad6a32776e82..3088e11055b5 100644 --- a/drivers/usb/class/cdc-acm.c +++ b/drivers/usb/class/cdc-acm.c @@ -367,9 +367,10 @@ static int acm_tty_write(struct tty_struct *tty, int from_user, const unsigned c count = (count > acm->writesize) ? acm->writesize : count; - if (from_user) - copy_from_user(acm->writeurb->transfer_buffer, buf, count); - else + if (from_user) { + if (copy_from_user(acm->writeurb->transfer_buffer, buf, count)) + return -EFAULT; + } else memcpy(acm->writeurb->transfer_buffer, buf, count); acm->writeurb->transfer_buffer_length = count; |