|
@@ -1267,6 +1267,10 @@ sys32_getdents (unsigned int fd, struct compat_dirent __user *dirent, unsigned i
|
|
|
struct getdents32_callback buf;
|
|
|
int error;
|
|
|
|
|
|
+ error = -EFAULT;
|
|
|
+ if (!access_ok(VERIFY_WRITE, dirent, count))
|
|
|
+ goto out;
|
|
|
+
|
|
|
error = -EBADF;
|
|
|
file = fget(fd);
|
|
|
if (!file)
|
|
@@ -1283,10 +1287,10 @@ sys32_getdents (unsigned int fd, struct compat_dirent __user *dirent, unsigned i
|
|
|
error = buf.error;
|
|
|
lastdirent = buf.previous;
|
|
|
if (lastdirent) {
|
|
|
- error = -EINVAL;
|
|
|
if (put_user(file->f_pos, &lastdirent->d_off))
|
|
|
- goto out_putf;
|
|
|
- error = count - buf.count;
|
|
|
+ error = -EFAULT;
|
|
|
+ else
|
|
|
+ error = count - buf.count;
|
|
|
}
|
|
|
|
|
|
out_putf:
|