Added checking of values returned by copy_to/from_user

to fulfill 2.6.x kernel rules.

diff --git a/lincan/src/ioctl.c b/lincan/src/ioctl.c
index f6f8ff44d12a35d883971377e9358b6fd6705498..38d75a4e68db6b79d34851b80c124872a3d909f2 100644 (file)
--- a/lincan/src/ioctl.c
+++ b/lincan/src/ioctl.c
@@ -78,7 +78,9 @@ int can_ioctl(struct inode *inode, struct file *file, unsigned int cmd, unsigned
                
                case CANQUE_FILTER: {
                        struct canfilt_t canfilt;
-                       copy_from_user(&canfilt, (void*)arg, sizeof(struct canfilt_t));
+                       int ret;
+                       ret = copy_from_user(&canfilt, (void*)arg, sizeof(struct canfilt_t));
+                       if(ret) return -EFAULT;
                        if(canuser->rx_edge0){
                                canque_set_filt(canuser->rx_edge0, canfilt.id, canfilt.mask, canfilt.flags);
                        }
@@ -89,10 +91,12 @@ int can_ioctl(struct inode *inode, struct file *file, unsigned int cmd, unsigned
                        int ret;
                        struct canmsg_t rtr_msg;
                        
-                       copy_from_user(&rtr_msg, (void*)arg, sizeof(struct canmsg_t));
+                       ret = copy_from_user(&rtr_msg, (void*)arg, sizeof(struct canmsg_t));
+                       if(ret) return -EFAULT;
                        ret = can_ioctl_remote_read(canuser, &rtr_msg, rtr_msg.id, 0);
                        if(ret<0) return ret;
-                       copy_to_user((void*)arg, &rtr_msg, sizeof(struct canmsg_t));
+                       ret = copy_to_user((void*)arg, &rtr_msg, sizeof(struct canmsg_t));
+                       if(ret) return -EFAULT;
                        break;
                }
 
@@ -110,7 +114,11 @@ int can_ioctl(struct inode *inode, struct file *file, unsigned int cmd, unsigned
                
                case CONF_BAUDPARAMS: {
                        struct can_baudparams_t params;
-                       copy_from_user(&params, (void*)arg, sizeof(struct can_baudparams_t));
+                       int ret;
+                       
+                       ret = copy_from_user(&params, (void*)arg, sizeof(struct can_baudparams_t));
+                       if(ret) return -EFAULT;
+
                        if(params.flags == -1) params.flags = 0;
                        if(params.baudrate == -1) params.baudrate = chip->baudrate;
                        if(params.sjw == -1) params.sjw = 0;

diff --git a/lincan/src/read.c b/lincan/src/read.c
index c16c76b5a723a1870f7fdf85c77b47b74fbf697f..a6f530573e1de1057fdf4f522bb84ae9a56f09e4 100644 (file)
--- a/lincan/src/read.c
+++ b/lincan/src/read.c
@@ -54,19 +54,21 @@ ssize_t can_read(struct file *file, char *buffer, size_t length, loff_t *offset)
                }
        }
        
-       copy_to_user(buffer, &slot->msg, sizeof(struct canmsg_t));
+       ret = copy_to_user(buffer, &slot->msg, sizeof(struct canmsg_t));
        canque_free_outslot(qends, qedge, slot);
        buffer += sizeof(struct canmsg_t);
        bytes_to_copy = length-sizeof(struct canmsg_t);
+       if(ret) return -EFAULT;
        
        while (bytes_to_copy > 0) {
                ret=canque_test_outslot(qends, &qedge, &slot);
                if(ret<0)
                        break;
-               copy_to_user(buffer, &slot->msg, sizeof(struct canmsg_t));
+               ret = copy_to_user(buffer, &slot->msg, sizeof(struct canmsg_t));
                canque_free_outslot(qends, qedge, slot);
                buffer += sizeof(struct canmsg_t);
                bytes_to_copy -= sizeof(struct canmsg_t);
+               if(ret) return -EFAULT;
        }
 
        return length-bytes_to_copy;

diff --git a/lincan/src/write.c b/lincan/src/write.c
index dccade1edbfc1a0e5eb88ebadb8d668752669d0d..4b65a1462f04d5f57e5218eb96566a246a09227c 100644 (file)
--- a/lincan/src/write.c
+++ b/lincan/src/write.c
@@ -20,7 +20,7 @@ ssize_t can_write(struct file *file, const char *buffer, size_t length, loff_t *
        struct canque_ends_t *qends;
        struct canque_edge_t *qedge;
        struct canque_slot_t *slot;
-       int ret = 0;
+       int ret;
        unsigned bytes_to_copy;
 
        if(!canuser || (canuser->magic != CAN_USER_MAGIC)){
@@ -53,7 +53,8 @@ ssize_t can_write(struct file *file, const char *buffer, size_t length, loff_t *
 
 
        /* Prepare first message */
-       copy_from_user(&msg_buff, buffer, sizeof(struct canmsg_t));
+       ret = copy_from_user(&msg_buff, buffer, sizeof(struct canmsg_t));
+       if(ret) return -EFAULT;
 
        /* Automatic selection of extended format if ID>2047 */
        if (msg_buff.id & ~0x7ffl & MSG_ID_MASK ) msg_buff.flags |= MSG_EXT;
@@ -91,7 +92,8 @@ ssize_t can_write(struct file *file, const char *buffer, size_t length, loff_t *
        while (bytes_to_copy >= sizeof(struct canmsg_t)) {
                bytes_to_copy -= sizeof(struct canmsg_t);
                /* Prepare first message */
-               copy_from_user(&msg_buff, buffer, sizeof(struct canmsg_t));
+               ret = copy_from_user(&msg_buff, buffer, sizeof(struct canmsg_t));
+               if(ret) return -EFAULT;
 
                /* Automatic selection of extended format if ID>2047 */
                if (msg_buff.id & ~0x7ffl & MSG_ID_MASK ) msg_buff.flags |= MSG_EXT;