#ifdef MODULE
#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,0))
MODULE_PARM(major_number, "b");
-@@ -1479,7 +1483,11 @@ struct proc_entry {
+@@ -1256,7 +1260,9 @@ static long MEI_Ioctl( struct file *filp
+ MEI_IOCTL_RETURN:
+
+ local_args.drv_ioctl.retCode = ret;
+- copy_to_user( ((IOCTL_MEI_arg_t *)nArgument), &local_args, retSize);
++ if ( ret == IFX_SUCCESS &&
++ copy_to_user( ((IOCTL_MEI_arg_t *)nArgument), &local_args, retSize) )
++ ret = -e_MEI_ERR_RETURN_ARG;
+
+ return (ret < 0) ? -1 : 0;
+ }
+@@ -1479,7 +1485,11 @@ struct proc_entry {
char name[32];
proc_rd_callback_t rd;
proc_wr_callback_t wr;
int entity;
};
-@@ -1869,6 +1877,7 @@ static int mei_proc_single_open(struct i
+@@ -1869,6 +1879,7 @@ static int mei_proc_single_open(struct i
static void mei_proc_entry_create(struct proc_dir_entry *parent_node,
struct proc_entry *proc_entry)
{
memset(&proc_entry->ops, 0, sizeof(struct file_operations));
proc_entry->ops.owner = THIS_MODULE;
-@@ -1879,6 +1888,17 @@ static void mei_proc_entry_create(struct
+@@ -1879,6 +1890,17 @@ static void mei_proc_entry_create(struct
proc_entry->ops.llseek = seq_lseek;
if (proc_entry->wr)
proc_entry->ops.write = proc_entry->wr;
proc_create_data(proc_entry->name,
(S_IFREG | S_IRUGO),
-@@ -2174,9 +2194,11 @@ static int MEI_module_init (void)
+@@ -2174,9 +2196,11 @@ static int MEI_module_init (void)
return (result);
}
return 0;
}
-@@ -2304,6 +2326,10 @@ static void MEI_module_exit (void)
+@@ -2304,6 +2328,10 @@ static void MEI_module_exit (void)
#else
unregister_chrdev ( major_number , DRV_MEI_NAME );
#endif
#if CONFIG_PROC_FS
-@@ -2388,9 +2414,11 @@ static void MEI_module_exit (void)
+@@ -2388,9 +2416,11 @@ static void MEI_module_exit (void)
("MEI_DRV: Chipset Basic Exit failed" MEI_DRV_CRLF));
}
#if (MEI_SUPPORT_DEBUG_LOGGER == 1)
if (nl_debug_sock)
-@@ -2514,6 +2542,10 @@ static int MEI_InitModuleRegCharDev(cons
+@@ -2514,6 +2544,10 @@ static int MEI_InitModuleRegCharDev(cons
("Using major number %d" MEI_DRV_CRLF, major_number));
}
return 0;
#endif /* CONFIG_DEVFS_FS */
}
-@@ -2563,21 +2595,32 @@ static int MEI_InitModuleBasics(void)
+@@ -2563,21 +2597,32 @@ static int MEI_InitModuleBasics(void)
}
#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,10,0))
return 0;
}
-@@ -2905,11 +2948,15 @@ IFX_int32_t MEI_IoctlInitDevice(
+@@ -2905,11 +2950,15 @@ IFX_int32_t MEI_IoctlInitDevice(
pMeiDev->eModePoll = e_MEI_DEV_ACCESS_MODE_IRQ;
pMeiDev->intMask = ME_ARC2ME_INTERRUPT_UNMASK_ALL;
pTmpXCntrl = MEI_VrxXDevToIrqListAdd(
MEI_DRV_LINENUM_GET(pMeiDev),
+@@ -3249,9 +3298,11 @@ static int MEI_IoctlMeiDbgAccessWr_Wrap(
+ ret = MEI_IoctlMeiDbgAccessWr( pMeiDynCntrl, pLocalArgument);
+
+ /* return arguments - count */
+- copy_to_user( (void *)&pUserArgument->count,
+- (void *)&pLocalArgument->count,
+- sizeof(pUserArgument->count) ) ;
++ if ( ret == IFX_SUCCESS &&
++ copy_to_user( (void *)&pUserArgument->count,
++ (void *)&pLocalArgument->count,
++ sizeof(pUserArgument->count) ) )
++ ret = -e_MEI_ERR_RETURN_ARG;
+
+ return ret;
+ }
+@@ -3278,16 +3329,18 @@ static int MEI_IoctlMeiDbgAccessRd_Wrap(
+ if ( pLocalArgument->count )
+ {
+ /* return the buffer */
+- copy_to_user( pUserBuf,
+- pLocalArgument->pData_32,
+- pLocalArgument->count * sizeof(IFX_uint32_t) ) ;
++ if ( copy_to_user( pUserBuf,
++ pLocalArgument->pData_32,
++ pLocalArgument->count * sizeof(IFX_uint32_t) ) )
++ ret = -e_MEI_ERR_RETURN_ARG;
+
+ }
+
+ /* return count argument */
+- copy_to_user( (void *)&pUserArgument->count,
+- (void *)&pLocalArgument->count,
+- sizeof(pUserArgument->count) ) ;
++ if ( copy_to_user( (void *)&pUserArgument->count,
++ (void *)&pLocalArgument->count,
++ sizeof(pUserArgument->count) ) )
++ ret = -e_MEI_ERR_RETURN_ARG;
+
+ return ret;
+ }
--- a/src/drv_mei_cpe_api_atm_ptm_intern.c
+++ b/src/drv_mei_cpe_api_atm_ptm_intern.c
@@ -147,6 +147,7 @@ IFX_int32_t MEI_InternalXtmSwhowtimeExit