This fix adds checks for inspecting the return value of put_user() and return
-EFAULT on error.
Signed-off-by: Kumar Amit Mehta <gmate.a...@gmail.com>
---
drivers/staging/dgrp/dgrp_tty.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/drivers/staging/dgrp/dgrp_tty.c b/drivers/staging/dgrp/dgrp_tty.c
index e125b03..b294197 100644
--- a/drivers/staging/dgrp/dgrp_tty.c
+++ b/drivers/staging/dgrp/dgrp_tty.c
@@ -2265,7 +2265,8 @@ static int get_modem_info(struct ch_struct *ch, unsigned
int *value)
| ((mlast & DM_RI) ? TIOCM_RNG : 0)
| ((mlast & DM_DSR) ? TIOCM_DSR : 0)
| ((mlast & DM_CTS) ? TIOCM_CTS : 0);
- put_user(mlast, (unsigned int __user *) value);
+ if (put_user(mlast, (unsigned int __user *) value))
+ return -EFAULT;
return 0;
}
@@ -2620,7 +2621,8 @@ static int dgrp_tty_ioctl(struct tty_struct *tty,
unsigned int cmd,
sizeof(long));
if (rc == 0)
return -EFAULT;
- put_user(C_CLOCAL(tty) ? 1 : 0, (unsigned long __user *) arg);
+ if (put_user(C_CLOCAL(tty) ? 1 : 0, (unsigned long __user *)
arg))
+ return -EFAULT;
return 0;
case TIOCSSOFTCAR:
@@ -2854,7 +2856,8 @@ static int dgrp_tty_ioctl(struct tty_struct *tty,
unsigned int cmd,
rc = access_ok(VERIFY_WRITE, (void __user *) arg, sizeof(int));
if (rc == 0)
return -EFAULT;
- put_user(ch->ch_custom_speed, (unsigned int __user *) arg);
+ if (put_user(ch->ch_custom_speed, (unsigned int __user *) arg))
+ return -EFAULT;
break;
case DIGI_SETCUSTOMBAUD:
--
1.7.9.5
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
