提交 a7be18d4 编写于 作者: A Alan Cox 提交者: Linus Torvalds

applicom: Fix an unchecked user ioctl range and an error return

Closes bug #11408 by checking the card index range for command 0
Fixes the ioctl to return ENOTTY which is correct for unknown ioctls
Signed-off-by: NAlan Cox <alan@redhat.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
上级 17b82060
...@@ -712,8 +712,7 @@ static int ac_ioctl(struct inode *inode, struct file *file, unsigned int cmd, un ...@@ -712,8 +712,7 @@ static int ac_ioctl(struct inode *inode, struct file *file, unsigned int cmd, un
IndexCard = adgl->num_card-1; IndexCard = adgl->num_card-1;
if(cmd != 0 && cmd != 6 && if(cmd != 6 && ((IndexCard >= MAX_BOARD) || !apbs[IndexCard].RamIO)) {
((IndexCard >= MAX_BOARD) || !apbs[IndexCard].RamIO)) {
static int warncount = 10; static int warncount = 10;
if (warncount) { if (warncount) {
printk( KERN_WARNING "APPLICOM driver IOCTL, bad board number %d\n",(int)IndexCard+1); printk( KERN_WARNING "APPLICOM driver IOCTL, bad board number %d\n",(int)IndexCard+1);
...@@ -832,8 +831,7 @@ static int ac_ioctl(struct inode *inode, struct file *file, unsigned int cmd, un ...@@ -832,8 +831,7 @@ static int ac_ioctl(struct inode *inode, struct file *file, unsigned int cmd, un
} }
break; break;
default: default:
printk(KERN_INFO "APPLICOM driver ioctl, unknown function code %d\n",cmd) ; ret = -ENOTTY;
ret = -EINVAL;
break; break;
} }
Dummy = readb(apbs[IndexCard].RamIO + VERS); Dummy = readb(apbs[IndexCard].RamIO + VERS);
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册