From: Markus Lidel <Markus.Lidel@shadowconnect.com>
Fix 64-bit problems.
---
25-akpm/drivers/message/i2o/i2o_config.c | 8 +++++++-
1 files changed, 7 insertions(+), 1 deletion(-)
diff -puN drivers/message/i2o/i2o_config.c~i2o-64-bit-fixes drivers/message/i2o/i2o_config.c
--- 25/drivers/message/i2o/i2o_config.c~i2o-64-bit-fixes Tue May 11 15:34:37 2004
+++ 25-akpm/drivers/message/i2o/i2o_config.c Tue May 11 15:34:37 2004
@@ -875,7 +875,9 @@ static int ioctl_passthru(unsigned long
/* Copy in the user's I2O command */
if(copy_from_user((void*)msg, (void*)user_msg, size))
return -EFAULT;
- get_user(reply_size, &user_reply[0]);
+ if(get_user(reply_size, &user_reply[0]) < 0)
+ return -EFAULT;
+
reply_size = reply_size>>16;
reply = kmalloc(REPLY_FRAME_SIZE*4, GFP_KERNEL);
if(!reply) {
@@ -889,6 +891,10 @@ static int ioctl_passthru(unsigned long
memset(sg_list,0, sizeof(sg_list[0])*SG_TABLESIZE);
if(sg_offset) {
+ if(sg_offset * 4 >= size) {
+ rcode = -EFAULT;
+ goto cleanup;
+ }
// TODO 64bit fix
struct sg_simple_element *sg = (struct sg_simple_element*) (msg+sg_offset);
sg_count = (size - sg_offset*4) / sizeof(struct sg_simple_element);
_