2.4.28-rc1, more lost patches [5/10]

[<sezeroz@ttnet.net.tr>]

[-- Attachment #1: Type: text/plain, Size: 116 bytes --]


[5/10] Alan Cox: appletalk dev copy/user stanford checker patch.

Not in 2.6, only in -ac/redhat. To be reviewed.


[-- Attachment #2: appletalk-dev-copy-user-checker.patch --]
[-- Type: application/octet-stream, Size: 1035 bytes --]


Alan Cox
only in -ac/redhat, _NOT_ in 2.6.

diff -urN 28rc1/net/appletalk/ddp.c 28rc1_aac/net/appletalk/ddp.c
--- 28rc1/net/appletalk/ddp.c	2004-10-24 00:45:51.000000000 +0300
+++ 28rc1_aac/net/appletalk/ddp.c	2004-10-24 00:58:12.000000000 +0300
@@ -978,6 +978,23 @@
 
 	if (copy_from_user(&rt, arg, sizeof(rt)))
 		return -EFAULT;
+		
+	if(rt.rt_dev)
+	{
+		char *colon;
+		struct net_device *dev;
+		char   devname[IFNAMSIZ];
+
+		if (copy_from_user(devname, rt.rt_dev, IFNAMSIZ-1))
+			return -EFAULT;
+		devname[IFNAMSIZ-1] = 0;
+		colon = strchr(devname, ':');
+		if (colon)
+			*colon = 0;
+		dev = __dev_get_by_name(devname);
+		if(dev == NULL)
+			return -ENODEV;
+	}
 
 	switch (cmd) {
 		case SIOCDELRT:
@@ -987,13 +1004,6 @@
 						&rt.rt_dst)->sat_addr);
 
 		case SIOCADDRT:
-			/* FIXME: the name of the device is still in user
-			 * space, isn't it? */
-			if (rt.rt_dev) {
-				dev = __dev_get_by_name(rt.rt_dev);
-				if (!dev)
-					return -ENODEV;
-			}			
 			return atrtr_create(&rt, dev);
 	}
 	return -EINVAL;