Added checking of values returned by copy_to/from_user

[lincan.git] / lincan / src / ioctl.c

diff --git a/lincan/src/ioctl.c b/lincan/src/ioctl.c
index f6f8ff44d12a35d883971377e9358b6fd6705498..38d75a4e68db6b79d34851b80c124872a3d909f2 100644 (file)
--- a/lincan/src/ioctl.c
+++ b/lincan/src/ioctl.c
@@ -78,7 +78,9 @@ int can_ioctl(struct inode *inode, struct file *file, unsigned int cmd, unsigned
                
                case CANQUE_FILTER: {
                        struct canfilt_t canfilt;
-                       copy_from_user(&canfilt, (void*)arg, sizeof(struct canfilt_t));
+                       int ret;
+                       ret = copy_from_user(&canfilt, (void*)arg, sizeof(struct canfilt_t));
+                       if(ret) return -EFAULT;
                        if(canuser->rx_edge0){
                                canque_set_filt(canuser->rx_edge0, canfilt.id, canfilt.mask, canfilt.flags);
                        }
@@ -89,10 +91,12 @@ int can_ioctl(struct inode *inode, struct file *file, unsigned int cmd, unsigned
                        int ret;
                        struct canmsg_t rtr_msg;
                        
-                       copy_from_user(&rtr_msg, (void*)arg, sizeof(struct canmsg_t));
+                       ret = copy_from_user(&rtr_msg, (void*)arg, sizeof(struct canmsg_t));
+                       if(ret) return -EFAULT;
                        ret = can_ioctl_remote_read(canuser, &rtr_msg, rtr_msg.id, 0);
                        if(ret<0) return ret;
-                       copy_to_user((void*)arg, &rtr_msg, sizeof(struct canmsg_t));
+                       ret = copy_to_user((void*)arg, &rtr_msg, sizeof(struct canmsg_t));
+                       if(ret) return -EFAULT;
                        break;
                }
 
@@ -110,7 +114,11 @@ int can_ioctl(struct inode *inode, struct file *file, unsigned int cmd, unsigned
                
                case CONF_BAUDPARAMS: {
                        struct can_baudparams_t params;
-                       copy_from_user(&params, (void*)arg, sizeof(struct can_baudparams_t));
+                       int ret;
+                       
+                       ret = copy_from_user(&params, (void*)arg, sizeof(struct can_baudparams_t));
+                       if(ret) return -EFAULT;
+
                        if(params.flags == -1) params.flags = 0;
                        if(params.baudrate == -1) params.baudrate = chip->baudrate;
                        if(params.sjw == -1) params.sjw = 0;