Commit 5e59be1f authored Sep 08, 2010 by Dan Carpenter Committed by David Woodhouse Oct 24, 2010

mtd: sanity check ioctl input



If "ur_idx" is wrong we could go past the end of the array.  The
"ur_idx" comes from root so it's not a huge deal, but adding a sanity
check makes the code more robust.

Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

parent 0eecf4b2

drivers/mtd/mtdchar.c

+3 −0

Original line number	Diff line number	Diff line
		@@ -546,6 +546,9 @@ static int mtd_ioctl(struct file *file, u_int cmd, u_long arg)
		if (get_user(ur_idx, &(ur->regionindex)))
		return -EFAULT;

		if (ur_idx >= mtd->numeraseregions)
		return -EINVAL;

		kr = &(mtd->eraseregions[ur_idx]);

		if (put_user(kr->offset, &(ur->offset))

Admin message