eccbf04a90
This fixes some places that dereference user pointers directly instead of using get_user(). Please especially check my changes to IOCTL_BCM_GET_CURRENT_STATUS. The original code modified the struct which "arg" was pointing to. I think this was a bug in the original code and that we only wanted to write to the OutputBuffer. Also with the original code you could read as much memory as you wanted so I had to put a cap on OutputLength. The only value of OutputLength that makes sense is sizeof(LINK_STATE) so now if OutputLength is not sizeof(LINK_STATE) it returns -EINVAL. Signed-off-by: Dan Carpenter <error27@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> |
||
|---|---|---|
| .. | ||
| Adapter.h | ||
| Arp.c | ||
| Bcmchar.c | ||
| Bcmnet.c | ||
| CmHost.c | ||
| CmHost.h | ||
| cntrl_SignalingInterface.h | ||
| DDRInit.c | ||
| DDRInit.h | ||
| Debug.c | ||
| Debug.h | ||
| HandleControlPacket.c | ||
| headers.h | ||
| hostmibs.c | ||
| HostMibs.h | ||
| HostMIBSInterface.h | ||
| InterfaceAdapter.h | ||
| InterfaceDld.c | ||
| InterfaceIdleMode.c | ||
| InterfaceIdleMode.h | ||
| InterfaceInit.c | ||
| InterfaceInit.h | ||
| InterfaceIsr.c | ||
| InterfaceIsr.h | ||
| InterfaceMacros.h | ||
| Interfacemain.h | ||
| InterfaceMisc.c | ||
| InterfaceMisc.h | ||
| InterfaceRx.c | ||
| InterfaceRx.h | ||
| InterfaceTx.c | ||
| InterfaceTx.h | ||
| Ioctl.h | ||
| IPv6Protocol.c | ||
| IPv6ProtocolHdr.h | ||
| Kconfig | ||
| LeakyBucket.c | ||
| led_control.c | ||
| led_control.h | ||
| Macros.h | ||
| Makefile | ||
| Misc.c | ||
| nvm.c | ||
| nvm.h | ||
| Osal_Misc.c | ||
| osal_misc.h | ||
| PHSDefines.h | ||
| PHSModule.c | ||
| PHSModule.h | ||
| Protocol.h | ||
| Prototypes.h | ||
| Qos.c | ||
| Queue.h | ||
| sort.c | ||
| target_params.h | ||
| TODO | ||
| Transmit.c | ||
| Typedefs.h | ||
| vendorspecificextn.c | ||
| vendorspecificextn.h | ||
| Version.h | ||