From eb0296b9e872ca43f1642284b46006a9f2a6c137 Mon Sep 17 00:00:00 2001 From: Alexander Viro Date: Mon, 26 Jul 2004 06:57:42 -0700 Subject: [PATCH] [PATCH] rndis fix blind dereferencing of userland pointers in procfs ->write() in rndis.c Signed-off-by: Linus Torvalds --- drivers/usb/gadget/rndis.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/drivers/usb/gadget/rndis.c b/drivers/usb/gadget/rndis.c index 676726ab54e9c..1cd445a01d137 100644 --- a/drivers/usb/gadget/rndis.c +++ b/drivers/usb/gadget/rndis.c @@ -1323,11 +1323,15 @@ int rndis_proc_read (char *page, char **start, off_t off, int count, int *eof, int rndis_proc_write (struct file *file, const char __user *buffer, unsigned long count, void *data) { + rndis_params *p = data; u32 speed = 0; int i, fl_speed = 0; for (i = 0; i < count; i++) { - switch (*buffer) { + char c; + if (get_user(c, buffer)) + return -EFAULT; + switch (c) { case '0': case '1': case '2': @@ -1339,21 +1343,19 @@ int rndis_proc_write (struct file *file, const char __user *buffer, case '8': case '9': fl_speed = 1; - speed = speed*10 + *buffer - '0'; + speed = speed*10 + c - '0'; break; case 'C': case 'c': - rndis_signal_connect (((rndis_params *) data) - ->confignr); + rndis_signal_connect (p->confignr); break; case 'D': case 'd': - rndis_signal_disconnect (((rndis_params *) data) - ->confignr); + rndis_signal_disconnect(p->confignr); break; default: - if (fl_speed) ((rndis_params *) data)->speed = speed; - else DEBUG ("%c is not valid\n", *buffer); + if (fl_speed) p->speed = speed; + else DEBUG ("%c is not valid\n", c); break; } -- 2.53.0