linux-hardened/drivers/staging/cxt1e1
Salva Peiró 084b6e7765 staging/cxt1e1/linux.c: Correct arbitrary memory write in c4_ioctl()
The function c4_ioctl() writes data from user in ifr->ifr_data
to the kernel struct data arg, without any iolen bounds checking.
This can lead to a arbitrary write outside of the struct data arg.
Corrected by adding bounds-checking of iolen before the copy_from_user().

Signed-off-by: Salva Peiró <speiro@ai2.upv.es>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-03-04 16:20:01 -08:00
..
comet.c
comet.h
comet_tables.c
comet_tables.h
functions.c
hwprobe.c
Kconfig
libsbew.h
linux.c staging/cxt1e1/linux.c: Correct arbitrary memory write in c4_ioctl() 2014-03-04 16:20:01 -08:00
Makefile
musycc.c
musycc.h
ossiRelease.c
pmc93x6_eeprom.c
pmc93x6_eeprom.h
pmcc4.h
pmcc4_cpld.h
pmcc4_defs.h
pmcc4_drv.c
pmcc4_ioctls.h
pmcc4_private.h
pmcc4_sysdep.h
sbe_bid.h
sbe_promformat.h
sbecom_inline_linux.h
sbecrc.c
sbeid.c
sbeproc.c
sbeproc.h
sbew_ioc.h