Commit 36c72ca2 authored by Jens Axboe's avatar Jens Axboe Committed by Linus Torvalds

[PATCH] check copy_from_user return value in sony535

From: Felipe W Damasio <felipewd@terra.com.br>

Found by smatch.
parent fb0dc60d
...@@ -1070,7 +1070,6 @@ cdu_ioctl(struct inode *inode, ...@@ -1070,7 +1070,6 @@ cdu_ioctl(struct inode *inode,
Byte cmd_buff[10], params[10]; Byte cmd_buff[10], params[10];
int i; int i;
int dsc_status; int dsc_status;
int err;
if (check_drive_status() != 0) if (check_drive_status() != 0)
return -EIO; return -EIO;
...@@ -1153,12 +1152,10 @@ cdu_ioctl(struct inode *inode, ...@@ -1153,12 +1152,10 @@ cdu_ioctl(struct inode *inode,
break; break;
case CDROMPLAYMSF: /* Play starting at the given MSF address. */ case CDROMPLAYMSF: /* Play starting at the given MSF address. */
err = verify_area(VERIFY_READ, (char *)arg, 6); if (copy_from_user(params, (void *)arg, 6))
if (err) return -EFAULT;
return err;
spin_up_drive(status); spin_up_drive(status);
set_drive_mode(SONY535_AUDIO_DRIVE_MODE, status); set_drive_mode(SONY535_AUDIO_DRIVE_MODE, status);
copy_from_user(params, (void *)arg, 6);
/* The parameters are given in int, must be converted */ /* The parameters are given in int, must be converted */
for (i = 0; i < 3; i++) { for (i = 0; i < 3; i++) {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment