084b6e7765
The function c4_ioctl() writes data from user in ifr->ifr_data to the kernel struct data arg, without any iolen bounds checking. This can lead to a arbitrary write outside of the struct data arg. Corrected by adding bounds-checking of iolen before the copy_from_user(). Signed-off-by: Salva Peiró <speiro@ai2.upv.es> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
|---|---|---|
| .. | ||
| Kconfig | ||
| Makefile | ||
| comet.c | ||
| comet.h | ||
| comet_tables.c | ||
| comet_tables.h | ||
| functions.c | ||
| hwprobe.c | ||
| libsbew.h | ||
| linux.c | ||
| musycc.c | ||
| musycc.h | ||
| ossiRelease.c | ||
| pmc93x6_eeprom.c | ||
| pmc93x6_eeprom.h | ||
| pmcc4.h | ||
| pmcc4_cpld.h | ||
| pmcc4_defs.h | ||
| pmcc4_drv.c | ||
| pmcc4_ioctls.h | ||
| pmcc4_private.h | ||
| pmcc4_sysdep.h | ||
| sbe_bid.h | ||
| sbe_promformat.h | ||
| sbecom_inline_linux.h | ||
| sbecrc.c | ||
| sbeid.c | ||
| sbeproc.c | ||
| sbeproc.h | ||
| sbew_ioc.h | ||