diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2014-03-09 18:58:27 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2014-03-09 18:58:27 -0700 |
| commit | a491ce72f8610c4a675baa45f5572886a2436959 (patch) | |
| tree | e23adf579497972d30799609ac05750a43a1011d | |
| parent | 979e0d74651ba5aa533277f2a6423d0f982fb6f6 (diff) | |
| parent | 084b6e7765b9554699afa23a50e702a3d0ae4b24 (diff) | |
Merge tag 'staging-3.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging
Pull staging driver tree fix from Greg KH:
"Here is a single staging driver fix for your tree.
It resolves an issue with arbritary writes to memory if a specific
driver is loaded"
* tag 'staging-3.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
staging/cxt1e1/linux.c: Correct arbitrary memory write in c4_ioctl()
| -rw-r--r-- | drivers/staging/cxt1e1/linux.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/staging/cxt1e1/linux.c b/drivers/staging/cxt1e1/linux.c index 4a08e16e42f7..79206cb3fb94 100644 --- a/drivers/staging/cxt1e1/linux.c +++ b/drivers/staging/cxt1e1/linux.c @@ -866,6 +866,8 @@ c4_ioctl (struct net_device *ndev, struct ifreq *ifr, int cmd) _IOC_SIZE (iocmd)); #endif iolen = _IOC_SIZE (iocmd); + if (iolen > sizeof(arg)) + return -EFAULT; data = ifr->ifr_data + sizeof (iocmd); if (copy_from_user (&arg, data, iolen)) return -EFAULT; |