patch-1.3.6 linux/drivers/net/eql.c

• Lines: 102
• Date: Thu Jun 29 19:18:50 1995
• Orig file: v1.3.5/linux/drivers/net/eql.c
• Orig date: Tue Jun 27 14:11:36 1995

diff -u --recursive --new-file v1.3.5/linux/drivers/net/eql.c linux/drivers/net/eql.c
@@ -144,9 +144,9 @@
 static int eql_slave_xmit(struct sk_buff *skb, struct device *dev); /*  */
 
 static struct enet_statistics *eql_get_stats(struct device *dev); /*  */
-static int eql_header(unsigned char *buff, struct device *dev, 
+static int eql_header(struct sk_buff *skb, struct device *dev, 
 		      unsigned short type, void *daddr, void *saddr, 
-		      unsigned len, struct sk_buff *skb); /*  */
+		      unsigned len); /*  */
 static int eql_rebuild_header(void *buff, struct device *dev, 
 			      unsigned long raddr, struct sk_buff *skb); /*  */
 
@@ -395,9 +395,9 @@
 
 static 
 int 
-eql_header(unsigned char *buff, struct device *dev, 
+eql_header(struct sk_buff *skb, struct device *dev, 
 	   unsigned short type, void *daddr, void *saddr, 
-	   unsigned len, struct sk_buff *skb)
+	   unsigned len)
 {
   return 0;
 }
@@ -424,6 +424,10 @@
   struct device *master_dev;
   struct device *slave_dev;
   slaving_request_t srq;
+  int err;
+
+  err = verify_area(VERIFY_READ, (void *)srqp, sizeof (slaving_request_t));
+  if (err) return err;
 
   memcpy_fromfs (&srq, srqp, sizeof (slaving_request_t));
 
@@ -469,6 +473,10 @@
   struct device *master_dev;
   struct device *slave_dev;
   slaving_request_t srq;
+  int err;
+
+  err = verify_area(VERIFY_READ, (void *)srqp, sizeof (slaving_request_t));
+  if (err) return err;
 
   memcpy_fromfs (&srq, srqp, sizeof (slaving_request_t));
 
@@ -502,6 +510,10 @@
   equalizer_t *eql;
   struct device *slave_dev;
   slave_config_t sc;
+  int err;
+
+  err = verify_area(VERIFY_READ, (void *)scp, sizeof (slave_config_t));
+  if (err) return err;
 
   memcpy_fromfs (&sc, scp, sizeof (slave_config_t));
 
@@ -519,6 +531,10 @@
       if (slave != 0)
 	{
 	  sc.priority = slave->priority;
+
+          err = verify_area(VERIFY_WRITE, (void *)scp, sizeof (slave_config_t));
+          if (err) return err;
+
 	  memcpy_tofs (scp, &sc, sizeof (slave_config_t));
 	  return 0;
 	}
@@ -535,6 +551,10 @@
   equalizer_t *eql;
   struct device *slave_dev;
   slave_config_t sc;
+  int err;
+
+  err = verify_area(VERIFY_READ, (void *)scp, sizeof (slave_config_t));
+  if (err) return err;
 
 #ifdef EQL_DEBUG
   if (eql_debug >= 20)
@@ -575,6 +595,11 @@
 
   if ( eql_is_master (dev) )
     {
+      int err;
+
+      err = verify_area(VERIFY_WRITE, (void *)mcp, sizeof (master_config_t));
+      if (err) return err;
+
       eql = (equalizer_t *) dev->priv;
       mc.max_slaves = eql->max_slaves;
       mc.min_slaves = eql->min_slaves;
@@ -591,6 +616,10 @@
 {
   equalizer_t *eql;
   master_config_t mc;
+ int err;
+
+ err = verify_area(VERIFY_READ, (void *)mcp, sizeof (master_config_t));
+ if (err) return err;
 
 #if EQL_DEBUG
   if (eql_debug >= 20)