Added checking of values returned by copy_to/from_user

[lincan.git] / lincan / src / ioctl.c

diff --git a/lincan/src/ioctl.c b/lincan/src/ioctl.c
index 6edca99e5ea2c1e65ca4269770ee31dd09eb95cd..38d75a4e68db6b79d34851b80c124872a3d909f2 100644 (file)
--- a/lincan/src/ioctl.c
+++ b/lincan/src/ioctl.c
@@ -78,12 +78,27 @@ int can_ioctl(struct inode *inode, struct file *file, unsigned int cmd, unsigned
                
                case CANQUE_FILTER: {
                        struct canfilt_t canfilt;
-                       copy_from_user(&canfilt, (void*)arg, sizeof(struct canfilt_t));
+                       int ret;
+                       ret = copy_from_user(&canfilt, (void*)arg, sizeof(struct canfilt_t));
+                       if(ret) return -EFAULT;
                        if(canuser->rx_edge0){
                                canque_set_filt(canuser->rx_edge0, canfilt.id, canfilt.mask, canfilt.flags);
                        }
                        break;
                }
+               
+               case CANRTR_READ: {
+                       int ret;
+                       struct canmsg_t rtr_msg;
+                       
+                       ret = copy_from_user(&rtr_msg, (void*)arg, sizeof(struct canmsg_t));
+                       if(ret) return -EFAULT;
+                       ret = can_ioctl_remote_read(canuser, &rtr_msg, rtr_msg.id, 0);
+                       if(ret<0) return ret;
+                       ret = copy_to_user((void*)arg, &rtr_msg, sizeof(struct canmsg_t));
+                       if(ret) return -EFAULT;
+                       break;
+               }
 
                case CONF_BAUD: {
                        channel = arg & 0xff;
@@ -99,7 +114,11 @@ int can_ioctl(struct inode *inode, struct file *file, unsigned int cmd, unsigned
                
                case CONF_BAUDPARAMS: {
                        struct can_baudparams_t params;
-                       copy_from_user(&params, (void*)arg, sizeof(struct can_baudparams_t));
+                       int ret;
+                       
+                       ret = copy_from_user(&params, (void*)arg, sizeof(struct can_baudparams_t));
+                       if(ret) return -EFAULT;
+
                        if(params.flags == -1) params.flags = 0;
                        if(params.baudrate == -1) params.baudrate = chip->baudrate;
                        if(params.sjw == -1) params.sjw = 0;