提交 20bf94e2 编写于 作者: L Linus Torvalds

Merge master.kernel.org:/pub/scm/linux/kernel/git/davem/sparc-2.6

* master.kernel.org:/pub/scm/linux/kernel/git/davem/sparc-2.6:
  [SPARC]: Fix regression in sys_getdomainname()
  [OPENPROMIO]: Handle current_node being NULL correctly.
...@@ -470,19 +470,21 @@ asmlinkage int sys_getdomainname(char __user *name, int len) ...@@ -470,19 +470,21 @@ asmlinkage int sys_getdomainname(char __user *name, int len)
{ {
int nlen, err; int nlen, err;
if (len < 0 || len > __NEW_UTS_LEN) if (len < 0)
return -EINVAL; return -EINVAL;
down_read(&uts_sem); down_read(&uts_sem);
nlen = strlen(system_utsname.domainname) + 1; nlen = strlen(system_utsname.domainname) + 1;
if (nlen < len) err = -EINVAL;
len = nlen; if (nlen > len)
goto out;
err = -EFAULT; err = -EFAULT;
if (!copy_to_user(name, system_utsname.domainname, len)) if (!copy_to_user(name, system_utsname.domainname, nlen))
err = 0; err = 0;
out:
up_read(&uts_sem); up_read(&uts_sem);
return err; return err;
} }
...@@ -707,19 +707,21 @@ asmlinkage long sys_getdomainname(char __user *name, int len) ...@@ -707,19 +707,21 @@ asmlinkage long sys_getdomainname(char __user *name, int len)
{ {
int nlen, err; int nlen, err;
if (len < 0 || len > __NEW_UTS_LEN) if (len < 0)
return -EINVAL; return -EINVAL;
down_read(&uts_sem); down_read(&uts_sem);
nlen = strlen(system_utsname.domainname) + 1; nlen = strlen(system_utsname.domainname) + 1;
if (nlen < len) err = -EINVAL;
len = nlen; if (nlen > len)
goto out;
err = -EFAULT; err = -EFAULT;
if (!copy_to_user(name, system_utsname.domainname, len)) if (!copy_to_user(name, system_utsname.domainname, nlen))
err = 0; err = 0;
out:
up_read(&uts_sem); up_read(&uts_sem);
return err; return err;
} }
......
...@@ -145,8 +145,9 @@ static int opromgetprop(void __user *argp, struct device_node *dp, struct openpr ...@@ -145,8 +145,9 @@ static int opromgetprop(void __user *argp, struct device_node *dp, struct openpr
void *pval; void *pval;
int len; int len;
pval = of_get_property(dp, op->oprom_array, &len); if (!dp ||
if (!pval || len <= 0 || len > bufsize) !(pval = of_get_property(dp, op->oprom_array, &len)) ||
len <= 0 || len > bufsize)
return copyout(argp, op, sizeof(int)); return copyout(argp, op, sizeof(int));
memcpy(op->oprom_array, pval, len); memcpy(op->oprom_array, pval, len);
...@@ -161,6 +162,8 @@ static int opromnxtprop(void __user *argp, struct device_node *dp, struct openpr ...@@ -161,6 +162,8 @@ static int opromnxtprop(void __user *argp, struct device_node *dp, struct openpr
struct property *prop; struct property *prop;
int len; int len;
if (!dp)
return copyout(argp, op, sizeof(int));
if (op->oprom_array[0] == '\0') { if (op->oprom_array[0] == '\0') {
prop = dp->properties; prop = dp->properties;
if (!prop) if (!prop)
...@@ -266,9 +269,13 @@ static int oprompci2node(void __user *argp, struct device_node *dp, struct openp ...@@ -266,9 +269,13 @@ static int oprompci2node(void __user *argp, struct device_node *dp, struct openp
static int oprompath2node(void __user *argp, struct device_node *dp, struct openpromio *op, int bufsize, DATA *data) static int oprompath2node(void __user *argp, struct device_node *dp, struct openpromio *op, int bufsize, DATA *data)
{ {
phandle ph = 0;
dp = of_find_node_by_path(op->oprom_array); dp = of_find_node_by_path(op->oprom_array);
if (dp)
ph = dp->node;
data->current_node = dp; data->current_node = dp;
*((int *)op->oprom_array) = dp->node; *((int *)op->oprom_array) = ph;
op->oprom_size = sizeof(int); op->oprom_size = sizeof(int);
return copyout(argp, op, bufsize + sizeof(int)); return copyout(argp, op, bufsize + sizeof(int));
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册