Attachment #74830 for bug #115700

View | Details | Raw Unified | Return to bug 115700
Collapse All | Expand All

Lines 351-359 Link Here

(-)lirc-0.7.2o/drivers/lirc_cmdir/lirc_cmdir.c (-1 / +1 lines)
351	unsigned int lobyte=0;	351	unsigned int lobyte=0;
352	int cmdir_cnt =0;	352	int cmdir_cnt =0;
353		353
354	if(n%sizeof(lirc_t)) return(-EINVAL);	354	if(n%sizeof(lirc_t)) return(-EINVAL);
355	retval=verify_area(VERIFY_READ,buf,n);	355	retval=access_ok(VERIFY_READ,buf,n) ? 0 : -EFAULT;
356	if(retval) return(retval);	356	if(retval) return(retval);
357		357
358	count=n/sizeof(lirc_t);	358	count=n/sizeof(lirc_t);
359	if(count>WBUF_LEN \|\| count%2==0) return(-EINVAL);	359	if(count>WBUF_LEN \|\| count%2==0) return(-EINVAL);




		{
			break;
		}
		
		retval=access_ok(VERIFY_WRITE,(void *) buf+n,
				   sizeof(lirc_t)) ? 0 : -EFAULT;
		if (retval)
		{
			return retval;
		}

	int retval;

        if(n%sizeof(lirc_t) || (n/sizeof(lirc_t)) > WBUF_LEN)
		return(-EINVAL);
	retval = access_ok(VERIFY_READ, buf, n) ? 0 : -EFAULT;
	if (retval)
		return retval;
	copy_from_user(tx_buf, buf, n);
	i = 0;




	DECLARE_WAITQUEUE(wait, current);
	
	if(n%sizeof(lirc_t)) return(-EINVAL);
	
	result=access_ok(VERIFY_WRITE,buf,n) ? 0 : -EFAULT;
	if(result) return(result);
	
	add_wait_queue(&lirc_wait,&wait);
	set_current_state(TASK_INTERRUPTIBLE);

	{
		return(-EBUSY);
	}
	if(n%sizeof(lirc_t)) return(-EINVAL);
	result=access_ok(VERIFY_READ,buf,n) ? 0 : -EFAULT;
	if(result) return(result);
	
	count=n/sizeof(lirc_t);
	

Lines 922-930 Link Here

(-)lirc-0.7.2o/drivers/lirc_serial/lirc_serial.c (-1 / +1 lines)
922	return(-EBADF);	922	return(-EBADF);
923	}	923	}
924		924
925	if(n%sizeof(lirc_t)) return(-EINVAL);	925	if(n%sizeof(lirc_t)) return(-EINVAL);
926	retval=verify_area(VERIFY_READ,buf,n);	926	retval=access_ok(VERIFY_READ,buf,n) ? 0 : -EFAULT;
927	if(retval) return(retval);	927	if(retval) return(retval);
928	count=n/sizeof(lirc_t);	928	count=n/sizeof(lirc_t);
929	if(count>WBUF_LEN \|\| count%2==0) return(-EINVAL);	929	if(count>WBUF_LEN \|\| count%2==0) return(-EINVAL);
930	copy_from_user(wbuf,buf,n);	930	copy_from_user(wbuf,buf,n);




	while(n<count)
	{
		if(rx_head!=rx_tail)
		{
			retval=access_ok(VERIFY_WRITE,
					   (void *) buf+n,sizeof(lirc_t)) ? 0 : -EFAULT;
			if (retval)
			{
				return retval;
			}

	int retval;

        if(n%sizeof(lirc_t) || (n/sizeof(lirc_t)) > WBUF_LEN)
		return(-EINVAL);
	retval = access_ok(VERIFY_READ, buf, n) ? 0 : -EFAULT;
	if (retval)
		return retval;
	copy_from_user(tx_buf, buf, n);
	i = 0;

Return to bug 115700

Lines 222-231 Link Here

(-)lirc-0.7.2o/drivers/lirc_it87/lirc_it87.c (-3 / +3 lines)
222	{	222	{
223	break;	223	break;
224	}	224	}
225		225
226	retval=verify_area(VERIFY_WRITE,(void *) buf+n,	226	retval=access_ok(VERIFY_WRITE,(void *) buf+n,
227	sizeof(lirc_t));	227	sizeof(lirc_t)) ? 0 : -EFAULT;
228	if (retval)	228	if (retval)
229	{	229	{
230	return retval;	230	return retval;
231	}	231	}
Lines 251-259 Link Here
251	int retval;	251	int retval;
252		252
253	if(n%sizeof(lirc_t) \|\| (n/sizeof(lirc_t)) > WBUF_LEN)	253	if(n%sizeof(lirc_t) \|\| (n/sizeof(lirc_t)) > WBUF_LEN)
254	return(-EINVAL);	254	return(-EINVAL);
255	retval = verify_area(VERIFY_READ, buf, n);	255	retval = access_ok(VERIFY_READ, buf, n) ? 0 : -EFAULT;
256	if (retval)	256	if (retval)
257	return retval;	257	return retval;
258	copy_from_user(tx_buf, buf, n);	258	copy_from_user(tx_buf, buf, n);
259	i = 0;	259	i = 0;

Lines 399-407 Link Here

(-)lirc-0.7.2o/drivers/lirc_parallel/lirc_parallel.c (-2 / +2 lines)
399	DECLARE_WAITQUEUE(wait, current);	399	DECLARE_WAITQUEUE(wait, current);
400		400
401	if(n%sizeof(lirc_t)) return(-EINVAL);	401	if(n%sizeof(lirc_t)) return(-EINVAL);
402		402
403	result=verify_area(VERIFY_WRITE,buf,n);	403	result=access_ok(VERIFY_WRITE,buf,n) ? 0 : -EFAULT;
404	if(result) return(result);	404	if(result) return(result);
405		405
406	add_wait_queue(&lirc_wait,&wait);	406	add_wait_queue(&lirc_wait,&wait);
407	set_current_state(TASK_INTERRUPTIBLE);	407	set_current_state(TASK_INTERRUPTIBLE);
Lines 448-456 Link Here
448	{	448	{
449	return(-EBUSY);	449	return(-EBUSY);
450	}	450	}
451	if(n%sizeof(lirc_t)) return(-EINVAL);	451	if(n%sizeof(lirc_t)) return(-EINVAL);
452	result=verify_area(VERIFY_READ,buf,n);	452	result=access_ok(VERIFY_READ,buf,n) ? 0 : -EFAULT;
453	if(result) return(result);	453	if(result) return(result);
454		454
455	count=n/sizeof(lirc_t);	455	count=n/sizeof(lirc_t);
456		456

Lines 313-322 Link Here

(-)lirc-0.7.2o/drivers/lirc_sir/lirc_sir.c (-3 / +3 lines)
313	while(n<count)	313	while(n<count)
314	{	314	{
315	if(rx_head!=rx_tail)	315	if(rx_head!=rx_tail)
316	{	316	{
317	retval=verify_area(VERIFY_WRITE,	317	retval=access_ok(VERIFY_WRITE,
318	(void *) buf+n,sizeof(lirc_t));	318	(void *) buf+n,sizeof(lirc_t)) ? 0 : -EFAULT;
319	if (retval)	319	if (retval)
320	{	320	{
321	return retval;	321	return retval;
322	}	322	}
Lines 355-363 Link Here
355	int retval;	355	int retval;
356		356
357	if(n%sizeof(lirc_t) \|\| (n/sizeof(lirc_t)) > WBUF_LEN)	357	if(n%sizeof(lirc_t) \|\| (n/sizeof(lirc_t)) > WBUF_LEN)
358	return(-EINVAL);	358	return(-EINVAL);
359	retval = verify_area(VERIFY_READ, buf, n);	359	retval = access_ok(VERIFY_READ, buf, n) ? 0 : -EFAULT;
360	if (retval)	360	if (retval)
361	return retval;	361	return retval;
362	copy_from_user(tx_buf, buf, n);	362	copy_from_user(tx_buf, buf, n);
363	i = 0;	363	i = 0;