Kernel/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2025-01-10 23:20:05 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

[MTD] mtdchar.c: Fix regression in MEMGETREGIONINFO ioctl()

Browse Source 
The MEMGETREGIONINFO ioctl() in mtdchar.c was clobbering user memory by
overwriting more than intended, due the size of struct mtd_erase_region_info
changing in commit 0ecbc81adfcb9f15f86b05ff576b342ce81bbef8 ('Support
for auto locking flash on power up').

Fix avoids this by copying struct members one by one with put_user(), as there
is no longer a convenient struct to use the size of as the length argument to
copy_to_user().

Signed-off-by: Zev Weiss <zevweiss@gmail.com>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
This commit is contained in:
Zev Weiss 2008-09-01 05:02:12 -07:00 committed by David Woodhouse
parent 02c0267a40
commit b67c5f87c1
1 changed files with 10 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
drivers/mtd/mtdchar.c
View File

@ -410,16 +410,20 @@ static int mtd_ioctl(struct inode *inode, struct file *file,
case MEMGETREGIONINFO:
{
struct region_info_user ur;
uint32_t ur_idx;
struct mtd_erase_region_info *kr;
struct region_info_user *ur = (struct region_info_user *) argp;
if (copy_from_user(&ur, argp, sizeof(struct region_info_user)))
if (get_user(ur_idx, &(ur->regionindex)))
return -EFAULT;
if (ur.regionindex >= mtd->numeraseregions)
return -EINVAL;
if (copy_to_user(argp, &(mtd->eraseregions[ur.regionindex]),
sizeof(struct mtd_erase_region_info)))
kr = &(mtd->eraseregions[ur_idx]);
if (put_user(kr->offset, &(ur->offset))
|| put_user(kr->erasesize, &(ur->erasesize))
|| put_user(kr->numblocks, &(ur->numblocks)))
return -EFAULT;
break;
}