00719fab9f
bcm driver copies a buffer length provided by userpace without checking it. RxCntrlMsgBitMask is of type unsigned long so only makes sense to copy sizeof(unsigned long) bytes. Also, copy_from_user() returns the number of bytes that could not be copied. The driver is returning that value as error code instead of -EFAULT. This patch solves both issues. Signed-off-by: Javier Martinez Canillas <martinez.javier@gmail.com> Cc: Stephen Hemminger <shemminger@vyatta.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> |
||
|---|---|---|
| .. | ||
| Adapter.h | ||
| Bcmchar.c | ||
| Bcmnet.c | ||
| CmHost.c | ||
| CmHost.h | ||
| DDRInit.c | ||
| DDRInit.h | ||
| Debug.h | ||
| HandleControlPacket.c | ||
| HostMIBSInterface.h | ||
| IPv6Protocol.c | ||
| IPv6ProtocolHdr.h | ||
| InterfaceAdapter.h | ||
| InterfaceDld.c | ||
| InterfaceIdleMode.c | ||
| InterfaceIdleMode.h | ||
| InterfaceInit.c | ||
| InterfaceInit.h | ||
| InterfaceIsr.c | ||
| InterfaceIsr.h | ||
| InterfaceMacros.h | ||
| InterfaceMisc.c | ||
| InterfaceMisc.h | ||
| InterfaceRx.c | ||
| InterfaceRx.h | ||
| InterfaceTx.c | ||
| InterfaceTx.h | ||
| Ioctl.h | ||
| Kconfig | ||
| LeakyBucket.c | ||
| Macros.h | ||
| Makefile | ||
| Misc.c | ||
| PHSDefines.h | ||
| PHSModule.c | ||
| PHSModule.h | ||
| Protocol.h | ||
| Prototypes.h | ||
| Qos.c | ||
| Queue.h | ||
| TODO | ||
| Transmit.c | ||
| Typedefs.h | ||
| Version.h | ||
| cntrl_SignalingInterface.h | ||
| headers.h | ||
| hostmibs.c | ||
| led_control.c | ||
| led_control.h | ||
| nvm.c | ||
| nvm.h | ||
| sort.c | ||
| target_params.h | ||
| vendorspecificextn.c | ||
| vendorspecificextn.h | ||