diff options
Diffstat (limited to 'fs/ncpfs')
| -rw-r--r-- | fs/ncpfs/dir.c | 3 | ||||
| -rw-r--r-- | fs/ncpfs/file.c | 2 | ||||
| -rw-r--r-- | fs/ncpfs/ioctl.c | 3 |
3 files changed, 5 insertions, 3 deletions
diff --git a/fs/ncpfs/dir.c b/fs/ncpfs/dir.c index 1c0f13e3b..eda3fe6af 100644 --- a/fs/ncpfs/dir.c +++ b/fs/ncpfs/dir.c @@ -342,7 +342,8 @@ ncp_d_validate(struct dentry *dentry) goto bad_addr; if ((dent_addr & ~align_mask) != dent_addr) goto bad_align; - if (!kern_addr_valid(dent_addr)) + if ((!kern_addr_valid(dent_addr)) || (!kern_addr_valid(dent_addr -1 + + sizeof(struct dentry)))) goto bad_addr; /* * Looks safe enough to dereference ... diff --git a/fs/ncpfs/file.c b/fs/ncpfs/file.c index a5c68e18c..139c9262d 100644 --- a/fs/ncpfs/file.c +++ b/fs/ncpfs/file.c @@ -256,7 +256,7 @@ ncp_file_write(struct file *file, const char *buf, size_t count, loff_t *ppos) } if (ncp_write_kernel(NCP_SERVER(inode), NCP_FINFO(inode)->file_handle, - pos, to_write, buf, &written_this_time) != 0) { + pos, to_write, bouncebuffer, &written_this_time) != 0) { errno = -EIO; break; } diff --git a/fs/ncpfs/ioctl.c b/fs/ncpfs/ioctl.c index f1c9099bc..4df91abe3 100644 --- a/fs/ncpfs/ioctl.c +++ b/fs/ncpfs/ioctl.c @@ -290,7 +290,8 @@ int ncp_ioctl(struct inode *inode, struct file *filp, return -EACCES; } /* get only low 8 bits... */ - get_user_ret(newstate, (unsigned char*)arg, -EFAULT); + if (get_user(newstate, (unsigned char *) arg)) + return -EFAULT; if (server->sign_active) { /* cannot turn signatures OFF when active */ if (!newstate) return -EINVAL; |