From: "Randy.Dunlap" , Daniele Bellucci This patch audit some copy_from/to_user in SysKonnect FDDI device driver. 25-akpm/drivers/net/skfp/skfddi.c | 8 ++++++-- 1 files changed, 6 insertions(+), 2 deletions(-) diff -puN drivers/net/skfp/skfddi.c~skfddi-copy_user-checks drivers/net/skfp/skfddi.c --- 25/drivers/net/skfp/skfddi.c~skfddi-copy_user-checks Thu Sep 4 11:26:12 2003 +++ 25-akpm/drivers/net/skfp/skfddi.c Thu Sep 4 11:26:12 2003 @@ -56,6 +56,8 @@ * 12-Nov-99 CG Source code release * 22-Nov-99 CG Included in kernel source. * 07-May-00 DM 64 bit fixes, new dma interface + * 31-Jul-03 DB Audit copy_*_user in skfp_ioctl + * Daniele Bellucci * * Compilation options (-Dxxx): * DRIVERDEBUG print lots of messages to log file @@ -1266,11 +1268,13 @@ static int skfp_ioctl(struct net_device struct s_skfp_ioctl ioc; int status = 0; - copy_from_user(&ioc, rq->ifr_data, sizeof(struct s_skfp_ioctl)); + if (copy_from_user(&ioc, rq->ifr_data, sizeof(struct s_skfp_ioctl))) + return -EFAULT; switch (ioc.cmd) { case SKFP_GET_STATS: /* Get the driver statistics */ ioc.len = sizeof(lp->MacStat); - copy_to_user(ioc.data, skfp_ctl_get_stats(dev), ioc.len); + status = copy_to_user(ioc.data, skfp_ctl_get_stats(dev), ioc.len) + ? -EFAULT : 0; break; case SKFP_CLR_STATS: /* Zero out the driver statistics */ if (!capable(CAP_NET_ADMIN)) { _