git://git.onelab.eu
/
linux-2.6.git
/ blobdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
|
commitdiff
|
tree
raw
|
inline
| side by side
vserver 1.9.5.x5
[linux-2.6.git]
/
fs
/
coda
/
upcall.c
diff --git
a/fs/coda/upcall.c
b/fs/coda/upcall.c
index
569e144
..
107dbfa
100644
(file)
--- a/
fs/coda/upcall.c
+++ b/
fs/coda/upcall.c
@@
-331,7
+331,7
@@
int venus_rename(struct super_block *sb, struct CodaFid *old_fid,
}
int venus_create(struct super_block *sb, struct CodaFid *dirfid,
}
int venus_create(struct super_block *sb, struct CodaFid *dirfid,
- const char *name, int length, int excl, int mode,
dev_t rdev,
+ const char *name, int length, int excl, int mode,
struct CodaFid *newfid, struct coda_vattr *attrs)
{
union inputArgs *inp;
struct CodaFid *newfid, struct coda_vattr *attrs)
{
union inputArgs *inp;
@@
-345,7
+345,6
@@
int venus_create(struct super_block *sb, struct CodaFid *dirfid,
inp->coda_create.VFid = *dirfid;
inp->coda_create.attr.va_mode = mode;
inp->coda_create.VFid = *dirfid;
inp->coda_create.attr.va_mode = mode;
- inp->coda_create.attr.va_rdev = huge_encode_dev(rdev);
inp->coda_create.excl = excl;
inp->coda_create.mode = mode;
inp->coda_create.name = offset;
inp->coda_create.excl = excl;
inp->coda_create.mode = mode;
inp->coda_create.name = offset;
@@
-555,6
+554,11
@@
int venus_pioctl(struct super_block *sb, struct CodaFid *fid,
goto exit;
}
goto exit;
}
+ if (data->vi.out_size > VC_MAXDATASIZE) {
+ error = -EINVAL;
+ goto exit;
+ }
+
inp->coda_ioctl.VFid = *fid;
/* the cmd field was mutated by increasing its size field to
inp->coda_ioctl.VFid = *fid;
/* the cmd field was mutated by increasing its size field to
@@
-583,19
+587,26
@@
int venus_pioctl(struct super_block *sb, struct CodaFid *fid,
error, coda_f2s(fid));
goto exit;
}
error, coda_f2s(fid));
goto exit;
}
+
+ if (outsize < (long)outp->coda_ioctl.data + outp->coda_ioctl.len) {
+ error = -EINVAL;
+ goto exit;
+ }
/* Copy out the OUT buffer. */
if (outp->coda_ioctl.len > data->vi.out_size) {
error = -EINVAL;
/* Copy out the OUT buffer. */
if (outp->coda_ioctl.len > data->vi.out_size) {
error = -EINVAL;
- } else {
- if (copy_to_user(data->vi.out,
- (char *)outp + (long)outp->coda_ioctl.data,
- data->vi.out_size)) {
- error = -EFAULT;
- goto exit;
- }
+ goto exit;
}
}
+ /* Copy out the OUT buffer. */
+ if (copy_to_user(data->vi.out,
+ (char *)outp + (long)outp->coda_ioctl.data,
+ outp->coda_ioctl.len)) {
+ error = -EFAULT;
+ goto exit;
+ }
+
exit:
CODA_FREE(inp, insize);
return error;
exit:
CODA_FREE(inp, insize);
return error;