Attachment 21268 Details for Bug 57096

[patch] patch to fix the hole

airo (text/plain), 2.43 KB, created by Andreas Kleen on 2004-06-16 20:48:34 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Andreas Kleen

Created: 2004-06-16 20:48:34 UTC

Size: 2.43 KB

patch

obsolete

>diff -u linux/drivers/net/wireless/airo.c-o linux/drivers/net/wireless/airo.c
>--- linux/drivers/net/wireless/airo.c-o	2004-06-15 12:06:53.000000000 +0200
>+++ linux/drivers/net/wireless/airo.c	2004-06-16 14:46:49.000000000 +0200
>@@ -4145,12 +4145,12 @@
>  */
> 
> static ssize_t proc_read( struct file *file,
>-			  char *buffer,
>+			  char __user *buffer,
> 			  size_t len,
> 			  loff_t *offset);
> 
> static ssize_t proc_write( struct file *file,
>-			   const char *buffer,
>+			   const char __user *buffer,
> 			   size_t len,
> 			   loff_t *offset );
> static int proc_close( struct inode *inode, struct file *file );
>@@ -4355,23 +4355,26 @@
>  *  to supply the data.
>  */
> static ssize_t proc_read( struct file *file,
>-			  char *buffer,
>+			  char __user *buffer,
> 			  size_t len,
> 			  loff_t *offset )
> {
>-	int i;
>-	int pos;
>+	loff_t pos = *offset;
> 	struct proc_data *priv = (struct proc_data*)file->private_data;
> 
>-	if( !priv->rbuffer ) return -EINVAL;
>+	if (!priv->rbuffer)
>+		return -EINVAL;
> 
>-	pos = *offset;
>-	for( i = 0; i+pos < priv->readlen && i < len; i++ ) {
>-		if (put_user( priv->rbuffer[i+pos], buffer+i ))
>-			return -EFAULT;
>-	}
>-	*offset += i;
>-	return i;
>+	if (pos < 0)
>+		return -EINVAL;
>+	if (pos >= priv->readlen)
>+		return 0;
>+	if (len > priv->readlen - pos)
>+		len = priv->readlen - pos;
>+	if (copy_to_user(buffer, priv->rbuffer + pos, len))
>+		return -EFAULT;
>+	*offset = pos + len;
>+	return len;
> }
> 
> /*
>@@ -4379,28 +4382,28 @@
>  *  to supply the data.
>  */
> static ssize_t proc_write( struct file *file,
>-			   const char *buffer,
>+			   const char __user *buffer,
> 			   size_t len,
> 			   loff_t *offset )
> {
>-	int i;
>-	int pos;
>+	loff_t pos = *offset;
> 	struct proc_data *priv = (struct proc_data*)file->private_data;
> 
>-	if ( !priv->wbuffer ) {
>+	if (!priv->wbuffer)
> 		return -EINVAL;
>-	}
>-
>-	pos = *offset;
> 
>-	for( i = 0; i + pos <  priv->maxwritelen &&
>-		     i < len; i++ ) {
>-		if (get_user( priv->wbuffer[i+pos], buffer + i ))
>-			return -EFAULT;
>-	}
>-	if ( i+pos > priv->writelen ) priv->writelen = i+file->f_pos;
>-	*offset += i;
>-	return i;
>+	if (pos < 0)
>+		return -EINVAL;
>+	if (pos >= priv->maxwritelen)
>+		return 0;
>+	if (len > priv->maxwritelen - pos)
>+		len = priv->maxwritelen - pos;
>+	if (copy_from_user(priv->wbuffer + pos, buffer, len))
>+		return -EFAULT;
>+	if (pos + len > priv->writelen)
>+		priv->writelen = pos + len;
>+	*offset = pos + len;
>+	return len;
> }
> 
> static int proc_status_open( struct inode *inode, struct file *file ) {

Actions: View | Diff

Attachments on bug 57096: 21268