Messages in this thread Patch in this message | | | Date | Mon, 01 Sep 2008 05:19:21 -0700 | From | Zev Weiss <> | Subject | Re: [PATCH] [MTD] mtdchar.c: Fix regression in MEMGETREGIONINFO ioctl() |
| |
From: Zev Weiss <zevweiss@gmail.com> Date: Mon, 1 Sep 2008 05:02:12 -0700 Subject: [PATCH] [MTD] mtdchar.c: Fix regression in MEMGETREGIONINFO ioctl()
The MEMGETREGIONINFO ioctl() in mtdchar.c was clobbering user memory by overwriting more than intended, due the size of struct mtd_erase_region_info changing in commit 0ecbc81adfcb9f15f86b05ff576b342ce81bbef8.
Fix avoids this by copying struct members one by one with put_user(), as there is no longer a convenient struct to use the size of as the length argument to copy_to_user().
Signed-off-by: Zev Weiss <zevweiss@gmail.com> --- drivers/mtd/mtdchar.c | 16 ++++++++++------ 1 files changed, 10 insertions(+), 6 deletions(-)
diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c index 13cc67a..424f318 100644 --- a/drivers/mtd/mtdchar.c +++ b/drivers/mtd/mtdchar.c @@ -410,16 +410,20 @@ static int mtd_ioctl(struct inode *inode, struct file *file,
case MEMGETREGIONINFO: { - struct region_info_user ur; + u32 ur_idx; + struct mtd_erase_region_info *kr; + struct region_info_user *ur = (struct region_info_user *) argp;
- if (copy_from_user(&ur, argp, sizeof(struct region_info_user))) + if (get_user(ur_idx,&(ur->regionindex))) return -EFAULT;
- if (ur.regionindex >= mtd->numeraseregions) - return -EINVAL; - if (copy_to_user(argp, &(mtd->eraseregions[ur.regionindex]), - sizeof(struct mtd_erase_region_info))) + kr = &(mtd->eraseregions[ur_idx]); + + if (put_user(kr->offset, &(ur->offset)) + || put_user(kr->erasesize, &(ur->erasesize)) + || put_user(kr->numblocks, &(ur->numblocks))) return -EFAULT; + break; }
-- 1.5.4.1
| |