From 2f5b7e8ce7b0c9e24f440823a78ab2d87665d4f4 Mon Sep 17 00:00:00 2001 From: Alan Cox Date: Mon, 7 Apr 2003 19:41:33 -0700 Subject: [PATCH] [PATCH] fix cosa verify_area --- drivers/net/wan/cosa.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/net/wan/cosa.c b/drivers/net/wan/cosa.c index efdd49fc01ded..1f8515602b09f 100644 --- a/drivers/net/wan/cosa.c +++ b/drivers/net/wan/cosa.c @@ -1057,7 +1057,8 @@ static inline int cosa_download(struct cosa_data *cosa, struct cosa_download *d) return -EPERM; } - if (get_user(addr, &(d->addr)) || + if (verify_area(VERIFY_READ, d, sizeof(*d)) || + __get_user(addr, &(d->addr)) || __get_user(len, &(d->len)) || __get_user(code, &(d->code))) return -EFAULT; @@ -1098,7 +1099,8 @@ static inline int cosa_readmem(struct cosa_data *cosa, struct cosa_download *d) return -EPERM; } - if (get_user(addr, &(d->addr)) || + if (verify_area(VERIFY_READ, d, sizeof(*d)) || + __get_user(addr, &(d->addr)) || __get_user(len, &(d->len)) || __get_user(code, &(d->code))) return -EFAULT; @@ -1106,7 +1108,7 @@ static inline int cosa_readmem(struct cosa_data *cosa, struct cosa_download *d) /* If something fails, force the user to reset the card */ cosa->firmware_status &= ~COSA_FW_RESET; - if ((i=readmem(cosa, d->code, len, addr)) < 0) { + if ((i=readmem(cosa, code, len, addr)) < 0) { printk(KERN_NOTICE "cosa%d: reading memory failed: %d\n", cosa->num, i); return -EIO; -- 2.53.0