[PATCH] usercopy checks in old_readdir()

Fix up some unchecked copy_to_user()s

diff --git a/fs/readdir.c b/fs/readdir.c
index 85109163731079d74812d21061c1a79063818381..2ee6de9550f73aabd703f63fd3499b0fec975963 100644 (file)
--- a/fs/readdir.c
+++ b/fs/readdir.c
@@ -72,11 +72,16 @@ static int fillonedir(void * __buf, const char * name, int namlen, loff_t offset
                return -EINVAL;
        buf->count++;
        dirent = buf->dirent;
-       put_user(ino, &dirent->d_ino);
-       put_user(offset, &dirent->d_offset);
-       put_user(namlen, &dirent->d_namlen);
-       copy_to_user(dirent->d_name, name, namlen);
-       put_user(0, dirent->d_name + namlen);
+       if (!access_ok(VERIFY_WRITE, (unsigned long)dirent,
+                       (unsigned long)(dirent->d_name + namlen + 1) -
+                               (unsigned long)dirent))
+               return -EFAULT;
+       if (    __put_user(ino, &dirent->d_ino) ||
+               __put_user(offset, &dirent->d_offset) ||
+               __put_user(namlen, &dirent->d_namlen) ||
+               __copy_to_user(dirent->d_name, name, namlen) ||
+               __put_user(0, dirent->d_name + namlen))
+               return -EFAULT;
        return 0;
 }