drivers/isdn/*.c

	- fix copy_{to,from}_user error handling (thanks to Rusty for pointing this out)

diff --git a/drivers/isdn/act2000/module.c b/drivers/isdn/act2000/module.c
index 3c9743862862c20fc2a9299bd3c581fd98e35b59..40953905b9c4702fba93be5d3c1f20c0b96a175d 100644 (file)
--- a/drivers/isdn/act2000/module.c
+++ b/drivers/isdn/act2000/module.c
@@ -283,16 +283,18 @@ act2000_command(act2000_card * card, isdn_ctrl * c)
                                        actcapi_manufacturer_req_net(card);
                                        return 0;
                                case ACT2000_IOCTL_SETMSN:
-                                       if ((ret = copy_from_user(tmp, (char *)a, sizeof(tmp))))
-                                               return ret;
+                                       if (copy_from_user(tmp, (char *)a,
+                                                          sizeof(tmp)))
+                                               return -EFAULT;
                                        if ((ret = act2000_set_msn(card, tmp)))
                                                return ret;
                                        if (card->flags & ACT2000_FLAGS_RUNNING)
                                                return(actcapi_manufacturer_req_msn(card));
                                        return 0;
                                case ACT2000_IOCTL_ADDCARD:
-                                       if ((ret = copy_from_user(&cdef, (char *)a, sizeof(cdef))))
-                                               return ret;
+                                       if (copy_from_user(&cdef, (char *)a,
+                                                          sizeof(cdef)))
+                                               return -EFAULT;
                                        if (act2000_addcard(cdef.bus, cdef.port, cdef.irq, cdef.id))
                                                return -EIO;
                                        return 0;

diff --git a/drivers/isdn/capi/capi.c b/drivers/isdn/capi/capi.c
index 5a9534d8baeb9af0cdaa233d11d4c756f56e5a28..b9a46041aaa8f0e50ea1f25c182546484e6d040e 100644 (file)
--- a/drivers/isdn/capi/capi.c
+++ b/drivers/isdn/capi/capi.c
@@ -673,10 +673,9 @@ capi_read(struct file *file, char *buf, size_t count, loff_t *ppos)
                skb_queue_head(&cdev->recvqueue, skb);
                return -EMSGSIZE;
        }
-       retval = copy_to_user(buf, skb->data, skb->len);
-       if (retval) {
+       if (copy_to_user(buf, skb->data, skb->len)) {
                skb_queue_head(&cdev->recvqueue, skb);
-               return retval;
+               return -EFAULT;
        }
        copied = skb->len;
 
@@ -703,7 +702,7 @@ capi_write(struct file *file, const char *buf, size_t count, loff_t *ppos)
        if (!skb)
                return -ENOMEM;
 
-       if ((retval = copy_from_user(skb_put(skb, count), buf, count))) {
+       if (copy_from_user(skb_put(skb, count), buf, count)) {
                kfree_skb(skb);
                return -EFAULT;
        }
@@ -782,45 +781,36 @@ capi_ioctl(struct inode *inode, struct file *file,
 
        case CAPI_GET_VERSION:
                {
-                       retval = copy_from_user((void *) &data.contr,
+                       if (copy_from_user((void *) &data.contr,
                                                (void *) arg,
-                                               sizeof(data.contr));
-                       if (retval)
+                                               sizeof(data.contr)))
                                return -EFAULT;
                        cdev->errcode = capi20_get_version(data.contr, &data.version);
                        if (cdev->errcode)
                                return -EIO;
-                       retval = copy_to_user((void *) arg,
-                                             (void *) &data.version,
-                                             sizeof(data.version));
-                       if (retval)
+                       if (copy_to_user((void *)arg, (void *)&data.version,
+                                        sizeof(data.version)))
                                return -EFAULT;
                }
                return 0;
 
        case CAPI_GET_SERIAL:
                {
-                       retval = copy_from_user((void *) &data.contr,
-                                               (void *) arg,
-                                               sizeof(data.contr));
-                       if (retval)
+                       if (copy_from_user((void *)&data.contr, (void *)arg,
+                                          sizeof(data.contr)))
                                return -EFAULT;
                        cdev->errcode = capi20_get_serial (data.contr, data.serial);
                        if (cdev->errcode)
                                return -EIO;
-                       retval = copy_to_user((void *) arg,
-                                             (void *) data.serial,
-                                             sizeof(data.serial));
-                       if (retval)
+                       if (copy_to_user((void *)arg, (void *)data.serial,
+                                        sizeof(data.serial)))
                                return -EFAULT;
                }
                return 0;
        case CAPI_GET_PROFILE:
                {
-                       retval = copy_from_user((void *) &data.contr,
-                                               (void *) arg,
-                                               sizeof(data.contr));
-                       if (retval)
+                       if (copy_from_user((void *)&data.contr, (void *)arg,
+                                          sizeof(data.contr)))
                                return -EFAULT;
 
                        if (data.contr == 0) {
@@ -848,18 +838,15 @@ capi_ioctl(struct inode *inode, struct file *file,
 
        case CAPI_GET_MANUFACTURER:
                {
-                       retval = copy_from_user((void *) &data.contr,
-                                               (void *) arg,
-                                               sizeof(data.contr));
-                       if (retval)
+                       if (copy_from_user((void *)&data.contr, (void *)arg,
+                                          sizeof(data.contr)))
                                return -EFAULT;
                        cdev->errcode = capi20_get_manufacturer(data.contr, data.manufacturer);
                        if (cdev->errcode)
                                return -EIO;
 
-                       retval = copy_to_user((void *) arg, (void *) data.manufacturer,
-                                             sizeof(data.manufacturer));
-                       if (retval)
+                       if (copy_to_user((void *)arg, (void *)data.manufacturer,
+                                        sizeof(data.manufacturer)))
                                return -EFAULT;
 
                }
@@ -868,10 +855,8 @@ capi_ioctl(struct inode *inode, struct file *file,
                data.errcode = cdev->errcode;
                cdev->errcode = CAPI_NOERROR;
                if (arg) {
-                       retval = copy_to_user((void *) arg,
-                                             (void *) &data.errcode,
-                                             sizeof(data.errcode));
-                       if (retval)
+                       if (copy_to_user((void *)arg, (void *)&data.errcode,
+                                        sizeof(data.errcode)))
                                return -EFAULT;
                }
                return data.errcode;
@@ -886,9 +871,8 @@ capi_ioctl(struct inode *inode, struct file *file,
                        struct capi_manufacturer_cmd mcmd;
                        if (!capable(CAP_SYS_ADMIN))
                                return -EPERM;
-                       retval = copy_from_user((void *) &mcmd, (void *) arg,
-                                               sizeof(mcmd));
-                       if (retval)
+                       if (copy_from_user((void *)&mcmd, (void *)arg,
+                                          sizeof(mcmd)))
                                return -EFAULT;
                        return capi20_manufacturer(mcmd.cmd, mcmd.data);
                }
@@ -898,10 +882,8 @@ capi_ioctl(struct inode *inode, struct file *file,
        case CAPI_CLR_FLAGS:
                {
                        unsigned userflags;
-                       retval = copy_from_user((void *) &userflags,
-                                               (void *) arg,
-                                               sizeof(userflags));
-                       if (retval)
+                       if (copy_from_user((void *)&userflags, (void *)arg,
+                                          sizeof(userflags)))
                                return -EFAULT;
                        if (cmd == CAPI_SET_FLAGS)
                                cdev->userflags |= userflags;
@@ -911,13 +893,9 @@ capi_ioctl(struct inode *inode, struct file *file,
                return 0;
 
        case CAPI_GET_FLAGS:
-               {
-                       retval = copy_to_user((void *) arg,
-                                             (void *) &cdev->userflags,
-                                             sizeof(cdev->userflags));
-                       if (retval)
-                               return -EFAULT;
-               }
+               if (copy_to_user((void *)arg, (void *)&cdev->userflags,
+                                sizeof(cdev->userflags)))
+                       return -EFAULT;
                return 0;
 
        case CAPI_NCCI_OPENCOUNT:
@@ -928,10 +906,8 @@ capi_ioctl(struct inode *inode, struct file *file,
 #endif /* CONFIG_ISDN_CAPI_MIDDLEWARE */
                        unsigned ncci;
                        int count = 0;
-                       retval = copy_from_user((void *) &ncci,
-                                               (void *) arg,
-                                               sizeof(ncci));
-                       if (retval)
+                       if (copy_from_user((void *)&ncci, (void *)arg,
+                                          sizeof(ncci)))
                                return -EFAULT;
                        nccip = capincci_find(cdev, (u32) ncci);
                        if (!nccip)
@@ -951,10 +927,8 @@ capi_ioctl(struct inode *inode, struct file *file,
                        struct capincci *nccip;
                        struct capiminor *mp;
                        unsigned ncci;
-                       retval = copy_from_user((void *) &ncci,
-                                               (void *) arg,
-                                               sizeof(ncci));
-                       if (retval)
+                       if (copy_from_user((void *)&ncci, (void *)arg,
+                                          sizeof(ncci)))
                                return -EFAULT;
                        nccip = capincci_find(cdev, (u32) ncci);
                        if (!nccip || (mp = nccip->minorp) == 0)

diff --git a/drivers/isdn/capi/kcapi.c b/drivers/isdn/capi/kcapi.c
index b3ce4372649ca15c63c6f2db57240c69745c6f2e..a609563d7c849f174dbf614ee258d67ee098aaa3 100644 (file)
--- a/drivers/isdn/capi/kcapi.c
+++ b/drivers/isdn/capi/kcapi.c
@@ -1060,15 +1060,15 @@ static int old_capi_manufacturer(unsigned int cmd, void *data)
        case AVMB1_LOAD_AND_CONFIG:
 
                if (cmd == AVMB1_LOAD) {
-                       if ((retval = copy_from_user((void *) &ldef, data,
-                                               sizeof(avmb1_loaddef))))
-                               return retval;
+                       if (copy_from_user((void *)&ldef, data,
+                                          sizeof(avmb1_loaddef)))
+                               return -EFAULT;
                        ldef.t4config.len = 0;
                        ldef.t4config.data = 0;
                } else {
-                       if ((retval = copy_from_user((void *) &ldef, data,
-                                               sizeof(avmb1_loadandconfigdef))))
-                               return retval;
+                       if (copy_from_user((void *)&ldef, data,
+                                          sizeof(avmb1_loadandconfigdef)))
+                               return -EFAULT;
                }
                card = get_capi_ctr_by_nr(ldef.contr);
                card = capi_ctr_get(card);
@@ -1123,9 +1123,8 @@ static int old_capi_manufacturer(unsigned int cmd, void *data)
                return 0;
 
        case AVMB1_RESETCARD:
-               if ((retval = copy_from_user((void *) &rdef, data,
-                                        sizeof(avmb1_resetdef))))
-                       return retval;
+               if (copy_from_user((void *)&rdef, data, sizeof(avmb1_resetdef)))
+                       return -EFAULT;
                card = get_capi_ctr_by_nr(rdef.contr);
                if (!card)
                        return -ESRCH;
@@ -1146,9 +1145,8 @@ static int old_capi_manufacturer(unsigned int cmd, void *data)
                return 0;
 
        case AVMB1_GET_CARDINFO:
-               if ((retval = copy_from_user((void *) &gdef, data,
-                                        sizeof(avmb1_getdef))))
-                       return retval;
+               if (copy_from_user((void *)&gdef, data, sizeof(avmb1_getdef)))
+                       return -EFAULT;
 
                card = get_capi_ctr_by_nr(gdef.contr);
                if (!card)
@@ -1159,9 +1157,8 @@ static int old_capi_manufacturer(unsigned int cmd, void *data)
                        gdef.cardtype = AVM_CARDTYPE_T1;
                else gdef.cardtype = AVM_CARDTYPE_B1;
 
-               if ((retval = copy_to_user(data, (void *) &gdef,
-                                        sizeof(avmb1_getdef))))
-                       return retval;
+               if (copy_to_user(data, (void *)&gdef, sizeof(avmb1_getdef)))
+                       return -EFAULT;
 
                return 0;
        }
@@ -1187,9 +1184,8 @@ int capi20_manufacturer(unsigned int cmd, void *data)
        {
                kcapi_flagdef fdef;
 
-               if ((retval = copy_from_user((void *) &fdef, data,
-                                        sizeof(kcapi_flagdef))))
-                       return retval;
+               if (copy_from_user((void *)&fdef, data, sizeof(kcapi_flagdef)))
+                       return -EFAULT;
 
                card = get_capi_ctr_by_nr(fdef.contr);
                if (!card)

diff --git a/drivers/isdn/divert/divert_procfs.c b/drivers/isdn/divert/divert_procfs.c
index 556223f4e080227dbfa976fda9cf98f6145baec3..a1845162fd4c3b1492a5e813c0e4ae1d981ef603 100644 (file)
--- a/drivers/isdn/divert/divert_procfs.c
+++ b/drivers/isdn/divert/divert_procfs.c
@@ -185,8 +185,8 @@ isdn_divert_ioctl(struct inode *inode, struct file *file,
        divert_rule *rulep;
        char *cp;
 
-       if ((i = copy_from_user(&dioctl, (char *) arg, sizeof(dioctl))))
-               return (i);
+       if (copy_from_user(&dioctl, (char *) arg, sizeof(dioctl)))
+               return -EFAULT;
 
        switch (cmd) {
                case IIOCGETVER:
@@ -254,7 +254,7 @@ isdn_divert_ioctl(struct inode *inode, struct file *file,
                default:
                        return (-EINVAL);
        }                       /* switch cmd */
-       return (copy_to_user((char *) arg, &dioctl, sizeof(dioctl)));   /* success */
+       return copy_to_user((char *)arg, &dioctl, sizeof(dioctl)) ? -EFAULT : 0;
 }                              /* isdn_divert_ioctl */
 
 

diff --git a/drivers/isdn/eicon/eicon_mod.c b/drivers/isdn/eicon/eicon_mod.c
index 6f1bbbedad19971a5a7ac44eb1d322bcab030d18..f51cffef1d6a37cb2c9fd580e92045151429d7f5 100644 (file)
--- a/drivers/isdn/eicon/eicon_mod.c
+++ b/drivers/isdn/eicon/eicon_mod.c
@@ -213,7 +213,10 @@ eicon_command(eicon_card * card, isdn_ctrl * c)
                                        return(EICON_CTRL_VERSION);
                                case EICON_IOCTL_GETTYPE:
                                        if (card->bus == EICON_BUS_PCI) {
-                                               copy_to_user((char *)a, &card->hwif.pci.master, sizeof(int));
+                                               if (copy_to_user((char *)a,
+                                                       &card->hwif.pci.master,
+                                                                sizeof(int)))
+                                                       return -EFAULT;
                                        }
                                        return(card->type);
                                case EICON_IOCTL_GETMMIO:
@@ -351,7 +354,8 @@ eicon_command(eicon_card * card, isdn_ctrl * c)
                                        return -ENODEV;
 
                                case EICON_IOCTL_ADDCARD:
-                                       if ((ret = copy_from_user(&cdef, (char *)a, sizeof(cdef))))
+                                       if (copy_from_user(&cdef, (char *)a,
+                                                          sizeof(cdef)))
                                                return -EFAULT;
                                        if (!(eicon_addcard(0, cdef.membase, cdef.irq, cdef.id, 0)))
                                                return -EIO;
@@ -376,8 +380,9 @@ eicon_command(eicon_card * card, isdn_ctrl * c)
 #ifdef CONFIG_ISDN_DRV_EICON_PCI
                                        if (c->arg < EICON_IOCTL_DIA_OFFSET)
                                                return -EINVAL;
-                                       if (copy_from_user(&dstart, (char *)a, sizeof(dstart)))
-                                               return -1;
+                                       if (copy_from_user(&dstart, (char *)a,
+                                                          sizeof(dstart)))
+                                               return -EFAULT;
                                        if (!(card = eicon_findnpcicard(dstart.card_id)))
                                                return -EINVAL;
                                        ret = do_ioctl(NULL, NULL,
@@ -667,7 +672,8 @@ if_readstatus(u_char * buf, int len, int user, int id, int channel)
 
                        if (user) {
                                spin_unlock_irqrestore(&eicon_lock, flags);
-                               copy_to_user(p, skb->data, cnt);
+                               if (copy_to_user(p, skb->data, cnt))
+                                       return -EFAULT;
                                spin_lock_irqsave(&eicon_lock, flags);
                        }
                        else

diff --git a/drivers/isdn/hardware/avm/b1.c b/drivers/isdn/hardware/avm/b1.c
index d44b7fe37ff112f38c3300d7215af84acaea628e..8f902c468972be087470339fd3c413a96cfa6a1d 100644 (file)
--- a/drivers/isdn/hardware/avm/b1.c
+++ b/drivers/isdn/hardware/avm/b1.c
@@ -166,15 +166,14 @@ int b1_load_t4file(avmcard *card, capiloaddatapart * t4file)
 {
        unsigned char buf[256];
        unsigned char *dp;
-       int i, left, retval;
+       int i, left;
        unsigned int base = card->port;
 
        dp = t4file->data;
        left = t4file->len;
        while (left > sizeof(buf)) {
                if (t4file->user) {
-                       retval = copy_from_user(buf, dp, sizeof(buf));
-                       if (retval)
+                       if (copy_from_user(buf, dp, sizeof(buf)))
                                return -EFAULT;
                } else {
                        memcpy(buf, dp, sizeof(buf));
@@ -190,8 +189,7 @@ int b1_load_t4file(avmcard *card, capiloaddatapart * t4file)
        }
        if (left) {
                if (t4file->user) {
-                       retval = copy_from_user(buf, dp, left);
-                       if (retval)
+                       if (copy_from_user(buf, dp, left))
                                return -EFAULT;
                } else {
                        memcpy(buf, dp, left);
@@ -211,7 +209,7 @@ int b1_load_config(avmcard *card, capiloaddatapart * config)
        unsigned char buf[256];
        unsigned char *dp;
        unsigned int base = card->port;
-       int i, j, left, retval;
+       int i, j, left;
 
        dp = config->data;
        left = config->len;
@@ -223,8 +221,7 @@ int b1_load_config(avmcard *card, capiloaddatapart * config)
        }
        while (left > sizeof(buf)) {
                if (config->user) {
-                       retval = copy_from_user(buf, dp, sizeof(buf));
-                       if (retval)
+                       if (copy_from_user(buf, dp, sizeof(buf)))
                                return -EFAULT;
                } else {
                        memcpy(buf, dp, sizeof(buf));
@@ -240,8 +237,7 @@ int b1_load_config(avmcard *card, capiloaddatapart * config)
        }
        if (left) {
                if (config->user) {
-                       retval = copy_from_user(buf, dp, left);
-                       if (retval)
+                       if (copy_from_user(buf, dp, left))
                                return -EFAULT;
                } else {
                        memcpy(buf, dp, left);

diff --git a/drivers/isdn/hardware/avm/c4.c b/drivers/isdn/hardware/avm/c4.c
index 731d06060739a61a4d06dfd344394818ed6a4470..5972a801c1f28a147265ce17bc84b1b6449a0795 100644 (file)
--- a/drivers/isdn/hardware/avm/c4.c
+++ b/drivers/isdn/hardware/avm/c4.c
@@ -191,15 +191,14 @@ static int c4_load_t4file(avmcard *card, capiloaddatapart * t4file)
 {
        u32 val;
        unsigned char *dp;
-       int left, retval;
+       int left;
        u32 loadoff = 0;
 
        dp = t4file->data;
        left = t4file->len;
        while (left >= sizeof(u32)) {
                if (t4file->user) {
-                       retval = copy_from_user(&val, dp, sizeof(val));
-                       if (retval)
+                       if (copy_from_user(&val, dp, sizeof(val)))
                                return -EFAULT;
                } else {
                        memcpy(&val, dp, sizeof(val));
@@ -216,8 +215,7 @@ static int c4_load_t4file(avmcard *card, capiloaddatapart * t4file)
        if (left) {
                val = 0;
                if (t4file->user) {
-                       retval = copy_from_user(&val, dp, left);
-                       if (retval)
+                       if (copy_from_user(&val, dp, left))
                                return -EFAULT;
                } else {
                        memcpy(&val, dp, left);
@@ -808,8 +806,7 @@ static int c4_send_config(avmcard *card, capiloaddatapart * config)
        left = config->len;
        while (left >= sizeof(u32)) {
                if (config->user) {
-                       retval = copy_from_user(val, dp, sizeof(val));
-                       if (retval)
+                       if (copy_from_user(val, dp, sizeof(val)))
                                return -EFAULT;
                } else {
                        memcpy(val, dp, sizeof(val));
@@ -822,8 +819,7 @@ static int c4_send_config(avmcard *card, capiloaddatapart * config)
        if (left) {
                memset(val, 0, sizeof(val));
                if (config->user) {
-                       retval = copy_from_user(&val, dp, left);
-                       if (retval)
+                       if (copy_from_user(&val, dp, left))
                                return -EFAULT;
                } else {
                        memcpy(&val, dp, left);

diff --git a/drivers/isdn/hisax/config.c b/drivers/isdn/hisax/config.c
index 25280172bb1b4716ed9e057a1582c69b07726560..8570c79868cc6fa1c3f9291484a1d638ceb40e38 100644 (file)
--- a/drivers/isdn/hisax/config.c
+++ b/drivers/isdn/hisax/config.c
@@ -641,9 +641,10 @@ int HiSax_readstatus(u_char * buf, int len, int user, int id, int channel)
                count = cs->status_end - cs->status_read + 1;
                if (count >= len)
                        count = len;
-               if (user)
-                       copy_to_user(p, cs->status_read, count);
-               else
+               if (user) {
+                       if (copy_to_user(p, cs->status_read, count))
+                               return -EFAULT;
+               } else
                        memcpy(p, cs->status_read, count);
                cs->status_read += count;
                if (cs->status_read > cs->status_end)
@@ -655,9 +656,10 @@ int HiSax_readstatus(u_char * buf, int len, int user, int id, int channel)
                                cnt = HISAX_STATUS_BUFSIZE;
                        else
                                cnt = count;
-                       if (user)
-                               copy_to_user(p, cs->status_read, cnt);
-                       else
+                       if (user) {
+                               if (copy_to_user(p, cs->status_read, cnt))
+                                       return -EFAULT;
+                       } else
                                memcpy(p, cs->status_read, cnt);
                        p += cnt;
                        cs->status_read += cnt % HISAX_STATUS_BUFSIZE;

diff --git a/drivers/isdn/hisax/isar.c b/drivers/isdn/hisax/isar.c
index 766428ed9e9d4a7a78e0036b8f6dfeceb268937c..322184c790c9f830f0f2344cafa97393bb34b21f 100644 (file)
--- a/drivers/isdn/hisax/isar.c
+++ b/drivers/isdn/hisax/isar.c
@@ -217,7 +217,7 @@ isar_load_firmware(struct IsdnCardState *cs, u_char *buf)
        }
        if ((ret = copy_from_user(&size, p, sizeof(int)))) {
                printk(KERN_ERR"isar_load_firmware copy_from_user ret %d\n", ret);
-               return ret;
+               return -EFAULT;
        }
        p += sizeof(int);
        printk(KERN_DEBUG"isar_load_firmware size: %d\n", size);
@@ -240,6 +240,7 @@ isar_load_firmware(struct IsdnCardState *cs, u_char *buf)
        while (cnt < size) {
                if ((ret = copy_from_user(&blk_head, p, BLK_HEAD_SIZE))) {
                        printk(KERN_ERR"isar_load_firmware copy_from_user ret %d\n", ret);
+                       ret = -EFAULT;
                        goto reterror;
                }
 #ifdef __BIG_ENDIAN
@@ -282,6 +283,7 @@ isar_load_firmware(struct IsdnCardState *cs, u_char *buf)
                        *mp++ = noc;
                        if ((ret = copy_from_user(tmpmsg, p, nom))) {
                                printk(KERN_ERR"isar_load_firmware copy_from_user ret %d\n", ret);
+                               ret = -EFAULT;
                                goto reterror;
                        }
                        p += nom;

diff --git a/drivers/isdn/i4l/isdn_ppp.c b/drivers/isdn/i4l/isdn_ppp.c
index 95d9f72a4f5e0555badff97d715c692c9fbaf975..622b69cadcd77da6cfc498e241bed8352037206d 100644 (file)
--- a/drivers/isdn/i4l/isdn_ppp.c
+++ b/drivers/isdn/i4l/isdn_ppp.c
@@ -731,7 +731,11 @@ isdn_ppp_read(struct file *file, char *buf, size_t count, loff_t *off)
 
        restore_flags(flags);
 
-       copy_to_user(buf, save_buf, count);
+       if (copy_to_user(buf, save_buf, count)) {
+               kfree(save_buf);
+               retval = -EFAULT;
+               goto out;
+       }
        kfree(save_buf);
 
        retval = count;

diff --git a/drivers/isdn/i4l/isdn_tty.c b/drivers/isdn/i4l/isdn_tty.c
index 0cb479b9e662d696d5cf34fff8e79af1db7810d6..18508e46a8b564c6d9e0b782890c52c634f28e53 100644 (file)
--- a/drivers/isdn/i4l/isdn_tty.c
+++ b/drivers/isdn/i4l/isdn_tty.c
@@ -1202,9 +1202,12 @@ isdn_tty_write(struct tty_struct *tty, int from_user, const u_char * buf, int co
                                                   &(m->pluscount),
                                                   &(m->lastplus),
                                                   from_user);
-                       if (from_user)
-                               copy_from_user(&(info->xmit_buf[info->xmit_count]), buf, c);
-                       else
+                       if (from_user) {
+                               if (copy_from_user(&(info->xmit_buf[info->xmit_count]), buf, c)) {
+                                       total = -EFAULT;
+                                       goto out;
+                               }
+                       } else
                                memcpy(&(info->xmit_buf[info->xmit_count]), buf, c);
 #ifdef CONFIG_ISDN_AUDIO
                        if (info->vonline) {
@@ -1284,6 +1287,7 @@ isdn_tty_write(struct tty_struct *tty, int from_user, const u_char * buf, int co
                }
                isdn_timer_ctrl(ISDN_TIMER_MODEMXMIT, 1);
        }
+out:
        if (from_user)
                up(&info->write_sem);
        return total;
@@ -2589,7 +2593,8 @@ isdn_tty_check_esc(const u_char * p, u_char plus, int count, int *pluscount,
                *pluscount = 0;
        }
        if (from_user) {
-               copy_from_user(cbuf, p, count);
+               if (copy_from_user(cbuf, p, count))
+                       return;
                p = cbuf;
        }
        while (count > 0) {

diff --git a/drivers/isdn/icn/icn.c b/drivers/isdn/icn/icn.c
index 22061b2f6925a5f59e58449e3e7dcb505c1811a1..d6c3de6fcc6fbb68be7cff06cbff8e564ed10b12 100644 (file)
--- a/drivers/isdn/icn/icn.c
+++ b/drivers/isdn/icn/icn.c
@@ -821,9 +821,9 @@ icn_loadboot(u_char * buffer, icn_card * card)
                printk(KERN_WARNING "icn: Could not allocate code buffer\n");
                return -ENOMEM;
        }
-       if ((ret = copy_from_user(codebuf, buffer, ICN_CODE_STAGE1))) {
+       if (copy_from_user(codebuf, buffer, ICN_CODE_STAGE1)) {
                kfree(codebuf);
-               return ret;
+               return -EFAULT;
        }
        if (!card->rvalid) {
                if (check_region(card->port, ICN_PORTLEN)) {
@@ -1057,9 +1057,10 @@ icn_writecmd(const u_char * buf, int len, int user, icn_card * card)
                count = cmd_free;
                if (count > len)
                        count = len;
-               if (user)
-                       copy_from_user(msg, buf, count);
-               else
+               if (user) {
+                       if (copy_from_user(msg, buf, count))
+                               return -EFAULT;
+               } else
                        memcpy(msg, buf, count);
 
                save_flags(flags);
@@ -1237,15 +1238,17 @@ icn_command(isdn_ctrl * c, icn_card * card)
                                case ICN_IOCTL_GETDOUBLE:
                                        return (int) card->doubleS0;
                                case ICN_IOCTL_DEBUGVAR:
-                                       if ((i = copy_to_user((char *) a,
-                                         (char *) &card, sizeof(ulong))))
-                                               return i;
+                                       if (copy_to_user((char *)a,
+                                                        (char *)&card,
+                                                        sizeof(ulong)))
+                                               return -EFAULT;
                                        a += sizeof(ulong);
                                        {
                                                ulong l = (ulong) & dev;
-                                               if ((i = copy_to_user((char *) a,
-                                                            (char *) &l, sizeof(ulong))))
-                                                       return i;
+                                               if (copy_to_user((char *)a,
+                                                                (char *)&l,
+                                                                sizeof(ulong)))
+                                                       return -EFAULT;
                                        }
                                        return 0;
                                case ICN_IOCTL_LOADBOOT:
@@ -1266,8 +1269,10 @@ icn_command(isdn_ctrl * c, icn_card * card)
                                case ICN_IOCTL_ADDCARD:
                                        if (!dev.firstload)
                                                return -EBUSY;
-                                       if ((i = copy_from_user((char *) &cdef, (char *) a, sizeof(cdef))))
-                                               return i;
+                                       if (copy_from_user((char *)&cdef,
+                                                          (char *)a,
+                                                          sizeof(cdef)))
+                                               return -EFAULT;
                                        return (icn_addcard(cdef.port, cdef.id1, cdef.id2));
                                        break;
                                case ICN_IOCTL_LEASEDCFG:

diff --git a/drivers/isdn/isdnloop/isdnloop.c b/drivers/isdn/isdnloop/isdnloop.c
index c551abfed701c5a332e04b549b928876d8cd4ae8..3fab06149f0ce1b9820ebb8e7d3c5a9035fe7c4f 100644 (file)
--- a/drivers/isdn/isdnloop/isdnloop.c
+++ b/drivers/isdn/isdnloop/isdnloop.c
@@ -986,9 +986,10 @@ isdnloop_writecmd(const u_char * buf, int len, int user, isdnloop_card * card)
 
                if (count > 255)
                        count = 255;
-               if (user)
-                       copy_from_user(msg, buf, count);
-               else
+               if (user) {
+                       if (copy_from_user(msg, buf, count))
+                               return -EFAULT;
+               } else
                        memcpy(msg, buf, count);
                isdnloop_putmsg(card, '>');
                for (p = msg; count > 0; count--, p++) {
@@ -1076,7 +1077,8 @@ isdnloop_start(isdnloop_card * card, isdnloop_sdef * sdefp)
 
        if (card->flags & ISDNLOOP_FLAGS_RUNNING)
                return -EBUSY;
-       copy_from_user((char *) &sdef, (char *) sdefp, sizeof(sdef));
+       if (copy_from_user((char *) &sdef, (char *) sdefp, sizeof(sdef)))
+               return -EFAULT;
        save_flags(flags);
        cli();
        switch (sdef.ptype) {
@@ -1149,9 +1151,10 @@ isdnloop_command(isdn_ctrl * c, isdnloop_card * card)
                                        return (isdnloop_start(card, (isdnloop_sdef *) a));
                                        break;
                                case ISDNLOOP_IOCTL_ADDCARD:
-                                       if ((i = verify_area(VERIFY_READ, (void *) a, sizeof(isdnloop_cdef))))
-                                               return i;
-                                       copy_from_user((char *) &cdef, (char *) a, sizeof(cdef));
+                                       if (copy_from_user((char *)&cdef,
+                                                          (char *)a,
+                                                          sizeof(cdef)))
+                                               return -EFAULT;
                                        return (isdnloop_addcard(cdef.id1));
                                        break;
                                case ISDNLOOP_IOCTL_LEASEDCFG:

diff --git a/drivers/isdn/sc/command.c b/drivers/isdn/sc/command.c
index 6825512a43d53d88c0853b5d0ff477a4f9be7a65..fd62630b5df867a1abf6372eeb826e67553411e1 100644 (file)
--- a/drivers/isdn/sc/command.c
+++ b/drivers/isdn/sc/command.c
@@ -126,11 +126,11 @@ int command(isdn_ctrl *cmd)
                int             err;
 
                memcpy(&cmdptr, cmd->parm.num, sizeof(unsigned long));
-               if((err = copy_from_user(&ioc, (scs_ioctl *) cmdptr, 
-                       sizeof(scs_ioctl)))) {
+               if (copy_from_user(&ioc, (scs_ioctl *)cmdptr,
+                                  sizeof(scs_ioctl))) {
                        pr_debug("%s: Failed to verify user space 0x%x\n",
                                adapter[card]->devicename, cmdptr);
-                       return err;
+                       return -EFAULT;
                }
                return sc_ioctl(card, &ioc);
        }

diff --git a/drivers/isdn/sc/ioctl.c b/drivers/isdn/sc/ioctl.c
index 807d85d36c6990dde0869da86d9ba99cbb26939e..2bc131a4ba29580f14360c9f60b3bdb318c3f289 100644 (file)
--- a/drivers/isdn/sc/ioctl.c
+++ b/drivers/isdn/sc/ioctl.c
@@ -55,8 +55,8 @@ int sc_ioctl(int card, scs_ioctl *data)
                /*
                 * Get the SRec from user space
                 */
-               if ((err = copy_from_user(srec, (char *) data->dataptr, sizeof(srec))))
-                       return err;
+               if (copy_from_user(srec, (char *) data->dataptr, sizeof(srec)))
+                       return -EFAULT;
 
                status = send_and_receive(card, CMPID, cmReqType2, cmReqClass0, cmReqLoadProc,
                                0, sizeof(srec), srec, &rcvmsg, SAR_TIMEOUT);
@@ -96,8 +96,9 @@ int sc_ioctl(int card, scs_ioctl *data)
                /*
                 * Get the switch type from user space
                 */
-               if ((err = copy_from_user(&switchtype, (char *) data->dataptr, sizeof(char))))
-                       return err;
+               if (copy_from_user(&switchtype, (char *)data->dataptr,
+                                  sizeof(char)))
+                       return -EFAULT;
 
                pr_debug("%s: SCIOCSETSWITCH: setting switch type to %d\n", adapter[card]->devicename,
                        switchtype);
@@ -141,8 +142,9 @@ int sc_ioctl(int card, scs_ioctl *data)
                /*
                 * Package the switch type and send to user space
                 */
-               if ((err = copy_to_user((char *) data->dataptr, &switchtype, sizeof(char))))
-                       return err;
+               if (copy_to_user((char *)data->dataptr, &switchtype,
+                                sizeof(char)))
+                       return -EFAULT;
 
                return 0;
        }
@@ -173,8 +175,8 @@ int sc_ioctl(int card, scs_ioctl *data)
                /*
                 * Package the switch type and send to user space
                 */
-               if ((err = copy_to_user((char *) data->dataptr, spid, sizeof(spid))))
-                       return err;
+               if (copy_to_user((char *)data->dataptr, spid, sizeof(spid)))
+                       return -EFAULT;
 
                return 0;
        }       
@@ -190,8 +192,8 @@ int sc_ioctl(int card, scs_ioctl *data)
                /*
                 * Get the spid from user space
                 */
-               if ((err = copy_from_user(spid, (char *) data->dataptr, sizeof(spid))))
-                       return err;
+               if (copy_from_user(spid, (char *) data->dataptr, sizeof(spid)))
+                       return -EFAULT;
 
                pr_debug("%s: SCIOCSETSPID: setting channel %d spid to %s\n", 
                        adapter[card]->devicename, data->channel, spid);
@@ -237,8 +239,8 @@ int sc_ioctl(int card, scs_ioctl *data)
                /*
                 * Package the dn and send to user space
                 */
-               if ((err = copy_to_user((char *) data->dataptr, dn, sizeof(dn))))
-                       return err;
+               if (copy_to_user((char *)data->dataptr, dn, sizeof(dn)))
+                       return -EFAULT;
 
                return 0;
        }       
@@ -254,8 +256,8 @@ int sc_ioctl(int card, scs_ioctl *data)
                /*
                 * Get the spid from user space
                 */
-               if ((err = copy_from_user(dn, (char *) data->dataptr, sizeof(dn))))
-                       return err;
+               if (copy_from_user(dn, (char *)data->dataptr, sizeof(dn)))
+                       return -EFAULT;
 
                pr_debug("%s: SCIOCSETDN: setting channel %d dn to %s\n", 
                        adapter[card]->devicename, data->channel, dn);
@@ -290,8 +292,9 @@ int sc_ioctl(int card, scs_ioctl *data)
                pr_debug("%s: SCIOSTAT: ioctl received\n", adapter[card]->devicename);
                GetStatus(card, &bi);
                
-               if ((err = copy_to_user((boardInfo *) data->dataptr, &bi, sizeof(boardInfo))))
-                       return err;
+               if (copy_to_user((boardInfo *)data->dataptr, &bi,
+                                sizeof(boardInfo)))
+                       return -EFAULT;
 
                return 0;
        }
@@ -324,8 +327,8 @@ int sc_ioctl(int card, scs_ioctl *data)
                /*
                 * Package the switch type and send to user space
                 */
-               if ((err = copy_to_user((char *) data->dataptr, &speed, sizeof(char))))
-                       return err;
+               if (copy_to_user((char *) data->dataptr, &speed, sizeof(char)))
+                       return -EFAULT;
 
                return 0;
        }

diff --git a/drivers/isdn/tpam/tpam_commands.c b/drivers/isdn/tpam/tpam_commands.c
index ca83345c3860f8b568e37f92ff5d192d581aae61..eb7e6eb8b8a26fa5c6606d72615fd6566eff40d5 100644 (file)
--- a/drivers/isdn/tpam/tpam_commands.c
+++ b/drivers/isdn/tpam/tpam_commands.c
@@ -126,7 +126,6 @@ int tpam_command(isdn_ctrl *c) {
  */
 static int tpam_command_ioctl_dspload(tpam_card *card, u32 arg) {
        tpam_dsp_ioctl tdl;
-       int ret;
 
        dprintk("TurboPAM(tpam_command_ioctl_dspload): card=%d\n", card->id);
 
@@ -141,10 +140,9 @@ static int tpam_command_ioctl_dspload(tpam_card *card, u32 arg) {
                return -EPERM;
 
        /* write the data in the board's memory */
-       ret = copy_from_user_to_pam(card, (void *)tdl.address, 
-                                   (void *)arg + sizeof(tpam_dsp_ioctl), 
-                                   tdl.data_len);
-       return 0;
+       return copy_from_user_to_pam(card, (void *)tdl.address, 
+                                    (void *)arg + sizeof(tpam_dsp_ioctl), 
+                                    tdl.data_len);
 }
 
 /*
@@ -158,7 +156,6 @@ static int tpam_command_ioctl_dspload(tpam_card *card, u32 arg) {
  */
 static int tpam_command_ioctl_dspsave(tpam_card *card, u32 arg) {
        tpam_dsp_ioctl tdl;
-       int ret;
 
        dprintk("TurboPAM(tpam_command_ioctl_dspsave): card=%d\n", card->id);
 
@@ -171,9 +168,8 @@ static int tpam_command_ioctl_dspsave(tpam_card *card, u32 arg) {
                return -EPERM;
 
        /* read the data from the board's memory */
-       ret = copy_from_pam_to_user(card, (void *)arg + sizeof(tpam_dsp_ioctl),
-                                   (void *)tdl.address, tdl.data_len);
-       return ret;
+       return copy_from_pam_to_user(card, (void *)arg + sizeof(tpam_dsp_ioctl),
+                                    (void *)tdl.address, tdl.data_len);
 }
 
 /*