From: Dan Carpenter <error27@gmail.com>
Date: Wed, 8 Sep 2010 19:39:56 +0000 (+0200)
Subject: mtd: sanity check ioctl input
X-Git-Url: http://git.lede-project.org./?a=commitdiff_plain;h=5e59be1f351b0ca9c5a43c627e3ed676ae93a941;p=openwrt%2Fstaging%2Fblogic.git

mtd: sanity check ioctl input

If "ur_idx" is wrong we could go past the end of the array.  The
"ur_idx" comes from root so it's not a huge deal, but adding a sanity
check makes the code more robust.

Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
---

diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c
index 1d981a5c1b13..5895de7018d4 100644
--- a/drivers/mtd/mtdchar.c
+++ b/drivers/mtd/mtdchar.c
@@ -546,6 +546,9 @@ static int mtd_ioctl(struct file *file, u_int cmd, u_long arg)
 		if (get_user(ur_idx, &(ur->regionindex)))
 			return -EFAULT;
 
+		if (ur_idx >= mtd->numeraseregions)
+			return -EINVAL;
+
 		kr = &(mtd->eraseregions[ur_idx]);
 
 		if (put_user(kr->offset, &(ur->offset))