From: Chris Wright Date: Sat, 4 Nov 2006 00:57:37 +0000 (-0800) Subject: isdn precursor to isdn patch which was already in queue X-Git-Tag: v2.6.18.2~1 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=05930f8db7ce55485b85b5e16acf1f781c8e235e;p=thirdparty%2Fkernel%2Fstable-queue.git isdn precursor to isdn patch which was already in queue --- diff --git a/queue-2.6.18/isdn-check-for-userspace-copy-faults.patch b/queue-2.6.18/isdn-check-for-userspace-copy-faults.patch new file mode 100644 index 00000000000..45997f59955 --- /dev/null +++ b/queue-2.6.18/isdn-check-for-userspace-copy-faults.patch @@ -0,0 +1,115 @@ +From 7786ce192fc4917fb9b789dd823476ff8fd6cf66 Mon Sep 17 00:00:00 2001 +From: Jeff Garzik +Date: Tue, 17 Oct 2006 00:10:40 -0700 +Subject: [PATCH] ISDN: check for userspace copy faults + +Most of the ISDN ->readstat() implementations needed to check +copy_to_user() and put_user() return values. + +Signed-off-by: Jeff Garzik +Cc: Karsten Keil +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Chris Wright +--- + drivers/isdn/capi/capidrv.c | 3 ++- + drivers/isdn/hisax/config.c | 6 ++++-- + drivers/isdn/icn/icn.c | 3 ++- + drivers/isdn/isdnloop/isdnloop.c | 3 ++- + drivers/isdn/pcbit/drv.c | 16 ++++++++++------ + 5 files changed, 20 insertions(+), 11 deletions(-) + +--- linux-2.6.18.1.orig/drivers/isdn/capi/capidrv.c ++++ linux-2.6.18.1/drivers/isdn/capi/capidrv.c +@@ -1907,7 +1907,8 @@ static int if_readstat(u8 __user *buf, i + } + + for (p=buf, count=0; count < len; p++, count++) { +- put_user(*card->q931_read++, p); ++ if (put_user(*card->q931_read++, p)) ++ return -EFAULT; + if (card->q931_read > card->q931_end) + card->q931_read = card->q931_buf; + } +--- linux-2.6.18.1.orig/drivers/isdn/hisax/config.c ++++ linux-2.6.18.1/drivers/isdn/hisax/config.c +@@ -631,7 +631,8 @@ static int HiSax_readstatus(u_char __use + count = cs->status_end - cs->status_read + 1; + if (count >= len) + count = len; +- copy_to_user(p, cs->status_read, count); ++ if (copy_to_user(p, cs->status_read, count)) ++ return -EFAULT; + cs->status_read += count; + if (cs->status_read > cs->status_end) + cs->status_read = cs->status_buf; +@@ -642,7 +643,8 @@ static int HiSax_readstatus(u_char __use + cnt = HISAX_STATUS_BUFSIZE; + else + cnt = count; +- copy_to_user(p, cs->status_read, cnt); ++ if (copy_to_user(p, cs->status_read, cnt)) ++ return -EFAULT; + p += cnt; + cs->status_read += cnt % HISAX_STATUS_BUFSIZE; + count -= cnt; +--- linux-2.6.18.1.orig/drivers/isdn/icn/icn.c ++++ linux-2.6.18.1/drivers/isdn/icn/icn.c +@@ -1010,7 +1010,8 @@ icn_readstatus(u_char __user *buf, int l + for (p = buf, count = 0; count < len; p++, count++) { + if (card->msg_buf_read == card->msg_buf_write) + return count; +- put_user(*card->msg_buf_read++, p); ++ if (put_user(*card->msg_buf_read++, p)) ++ return -EFAULT; + if (card->msg_buf_read > card->msg_buf_end) + card->msg_buf_read = card->msg_buf; + } +--- linux-2.6.18.1.orig/drivers/isdn/isdnloop/isdnloop.c ++++ linux-2.6.18.1/drivers/isdn/isdnloop/isdnloop.c +@@ -451,7 +451,8 @@ isdnloop_readstatus(u_char __user *buf, + for (p = buf, count = 0; count < len; p++, count++) { + if (card->msg_buf_read == card->msg_buf_write) + return count; +- put_user(*card->msg_buf_read++, p); ++ if (put_user(*card->msg_buf_read++, p)) ++ return -EFAULT; + if (card->msg_buf_read > card->msg_buf_end) + card->msg_buf_read = card->msg_buf; + } +--- linux-2.6.18.1.orig/drivers/isdn/pcbit/drv.c ++++ linux-2.6.18.1/drivers/isdn/pcbit/drv.c +@@ -725,23 +725,27 @@ static int pcbit_stat(u_char __user *buf + + if (stat_st < stat_end) + { +- copy_to_user(buf, statbuf + stat_st, len); ++ if (copy_to_user(buf, statbuf + stat_st, len)) ++ return -EFAULT; + stat_st += len; + } + else + { + if (len > STATBUF_LEN - stat_st) + { +- copy_to_user(buf, statbuf + stat_st, +- STATBUF_LEN - stat_st); +- copy_to_user(buf, statbuf, +- len - (STATBUF_LEN - stat_st)); ++ if (copy_to_user(buf, statbuf + stat_st, ++ STATBUF_LEN - stat_st)) ++ return -EFAULT; ++ if (copy_to_user(buf, statbuf, ++ len - (STATBUF_LEN - stat_st))) ++ return -EFAULT; + + stat_st = len - (STATBUF_LEN - stat_st); + } + else + { +- copy_to_user(buf, statbuf + stat_st, len); ++ if (copy_to_user(buf, statbuf + stat_st, len)) ++ return -EFAULT; + + stat_st += len; + diff --git a/queue-2.6.18/series b/queue-2.6.18/series index b54b7ae146a..abb1226f48a 100644 --- a/queue-2.6.18/series +++ b/queue-2.6.18/series @@ -46,6 +46,7 @@ watchdog-sc1200wdt-fix-missing-pnp_unregister_driver.patch fix-intel-rng-detection.patch posix-cpu-timers-prevent-signal-delivery-starvation.patch rtc-max6902-month-conversion-fix.patch +isdn-check-for-userspace-copy-faults.patch isdn-fix-drivers-by-handling-errors-thrown-by-readstat.patch sparc64-fix-pci-memory-space-root-resource-on-hummingbird.patch pci-remove-quirk_via_abnormal_poweroff.patch