patch-2.1.11 linux/drivers/isdn/icn/icn.c

• Lines: 74
• Date: Mon Nov 18 11:31:31 1996
• Orig file: v2.1.10/linux/drivers/isdn/icn/icn.c
• Orig date: Sat Aug 31 19:01:48 1996

diff -u --recursive --new-file v2.1.10/linux/drivers/isdn/icn/icn.c linux/drivers/isdn/icn/icn.c
@@ -842,7 +842,8 @@
         icn_lock_channel(card,0);                                  /* Lock Bank 0      */
         restore_flags(flags);
         SLEEP(1);
-        memcpy_fromfs(codebuf, buffer, ICN_CODE_STAGE1);
+        if (copy_from_user(codebuf, buffer, ICN_CODE_STAGE1))
+        	return -EFAULT;
         memcpy_toio(dev.shmem, codebuf, ICN_CODE_STAGE1);           /* Copy code        */
 #ifdef BOOT_DEBUG
         printk(KERN_DEBUG "Bootloader transfered\n");
@@ -913,7 +914,8 @@
         while (left) {
                 if (sbfree) {                           /* If there is a free buffer...  */
                         cnt = MIN(256, left);
-                        memcpy_fromfs(codebuf, p, cnt);
+                        if (copy_from_user(codebuf, p, cnt))
+                        	/* FIXME -WRONG */return -EFAULT;
                         memcpy_toio(&sbuf_l, codebuf, cnt); /* copy data                     */ 
                         sbnext;                         /* switch to next buffer         */
                         p += cnt;
@@ -995,7 +997,7 @@
                 if (card->msg_buf_read == card->msg_buf_write)
                         return count;
                 if (user)
-                        put_fs_byte(*card->msg_buf_read++, p);
+                        put_user(*card->msg_buf_read++, p);
                 else
                         *p = *card->msg_buf_read++;
                 if (card->msg_buf_read > card->msg_buf_end)
@@ -1023,7 +1025,13 @@
                         avail = cmd_free;
                         count = MIN(avail, len);
                         if (user)
-                                memcpy_fromfs(msg, buf, count);
+                        {
+                                if (copy_from_user(msg, buf, count) != 0)
+                                {
+                                	icn_release_channel();
+                                	return -EFAULT;
+                                }
+                        }
                         else
                                 memcpy(msg, buf, count);
                         save_flags(flags);
@@ -1175,13 +1183,15 @@
                                                     (void *) a,
                                                     sizeof(ulong) * 2)))
                                         return i;
-                                memcpy_tofs((char *)a,
-                                            (char *)&card, sizeof(ulong));
+                                if (copy_to_user((char *)a,
+                                            (char *)&card, sizeof(ulong)))
+                                            	return -EFAULT;
 				a += sizeof(ulong);
 				{
                                         ulong l = (ulong)&dev;
-                                        memcpy_tofs((char *)a,
-                                                    (char *)&l, sizeof(ulong));
+                                        if (copy_to_user((char *)a,
+                                                    (char *)&l, sizeof(ulong)))
+                                                    return -EFAULT;
                                 }
                                 return 0;
                         case ICN_IOCTL_LOADBOOT:
@@ -1198,7 +1208,8 @@
                         case ICN_IOCTL_ADDCARD:
                                 if ((i = verify_area(VERIFY_READ, (void *) a, sizeof(icn_cdef))))
                                         return i;
-                                memcpy_fromfs((char *)&cdef, (char *)a, sizeof(cdef));
+                                if (copy_from_user((char *)&cdef, (char *)a, sizeof(cdef)))
+                                	return -EFAULT;
                                 return (icn_addcard(cdef.port, cdef.id1, cdef.id2));
                                 break;
                         case ICN_IOCTL_LEASEDCFG: