diff options
| -rw-r--r-- | drivers/staging/lustre/lnet/libcfs/linux/linux-module.c | 15 |
1 files changed, 13 insertions, 2 deletions
diff --git a/drivers/staging/lustre/lnet/libcfs/linux/linux-module.c b/drivers/staging/lustre/lnet/libcfs/linux/linux-module.c index 3f5d58b..075826b 100644 --- a/drivers/staging/lustre/lnet/libcfs/linux/linux-module.c +++ b/drivers/staging/lustre/lnet/libcfs/linux/linux-module.c @@ -122,7 +122,7 @@ int libcfs_ioctl_getdata(struct libcfs_ioctl_hdr **hdr_pp, const struct libcfs_ioctl_hdr __user *uhdr) { struct libcfs_ioctl_hdr hdr; - int err = 0; + int err; if (copy_from_user(&hdr, uhdr, sizeof(hdr))) return -EFAULT; @@ -150,9 +150,20 @@ int libcfs_ioctl_getdata(struct libcfs_ioctl_hdr **hdr_pp, return -ENOMEM; if (copy_from_user(*hdr_pp, uhdr, hdr.ioc_len)) { - LIBCFS_FREE(*hdr_pp, hdr.ioc_len); err = -EFAULT; + goto free; } + + if ((*hdr_pp)->ioc_version != hdr.ioc_version || + (*hdr_pp)->ioc_len != hdr.ioc_len) { + err = -EINVAL; + goto free; + } + + return 0; + +free: + LIBCFS_FREE(*hdr_pp, hdr.ioc_len); return err; } |
