Commit 5e59be1f authored by Dan Carpenter's avatar Dan Carpenter Committed by David Woodhouse

mtd: sanity check ioctl input

If "ur_idx" is wrong we could go past the end of the array.  The
"ur_idx" comes from root so it's not a huge deal, but adding a sanity
check makes the code more robust.
Signed-off-by: default avatarDan Carpenter <error27@gmail.com>
Signed-off-by: default avatarArtem Bityutskiy <Artem.Bityutskiy@nokia.com>
Signed-off-by: default avatarDavid Woodhouse <David.Woodhouse@intel.com>
parent 0eecf4b2
...@@ -546,6 +546,9 @@ static int mtd_ioctl(struct file *file, u_int cmd, u_long arg) ...@@ -546,6 +546,9 @@ static int mtd_ioctl(struct file *file, u_int cmd, u_long arg)
if (get_user(ur_idx, &(ur->regionindex))) if (get_user(ur_idx, &(ur->regionindex)))
return -EFAULT; return -EFAULT;
if (ur_idx >= mtd->numeraseregions)
return -EINVAL;
kr = &(mtd->eraseregions[ur_idx]); kr = &(mtd->eraseregions[ur_idx]);
if (put_user(kr->offset, &(ur->offset)) if (put_user(kr->offset, &(ur->offset))
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment