|
@@ -866,6 +866,8 @@ c4_ioctl (struct net_device *ndev, struct ifreq *ifr, int cmd)
|
|
|
_IOC_SIZE (iocmd));
|
|
_IOC_SIZE (iocmd));
|
|
|
#endif
|
|
#endif
|
|
|
iolen = _IOC_SIZE (iocmd);
|
|
iolen = _IOC_SIZE (iocmd);
|
|
|
|
|
+ if (iolen > sizeof(arg))
|
|
|
|
|
+ return -EFAULT;
|
|
|
data = ifr->ifr_data + sizeof (iocmd);
|
|
data = ifr->ifr_data + sizeof (iocmd);
|
|
|
if (copy_from_user (&arg, data, iolen))
|
|
if (copy_from_user (&arg, data, iolen))
|
|
|
return -EFAULT;
|
|
return -EFAULT;
|