diff --git a/[refs] b/[refs] index a32faa209e3c..4b24c2243676 100644 --- a/[refs] +++ b/[refs] @@ -1,2 +1,2 @@ --- -refs/heads/master: 01da41b86f6e5f9a724e20a63f093d77e37d8056 +refs/heads/master: 2c8307f63dd5caaf7ff8ad5118951e559a9ed5c8 diff --git a/trunk/arch/parisc/kernel/sys_parisc32.c b/trunk/arch/parisc/kernel/sys_parisc32.c index ce3245f87fdd..a8ebac4fadec 100644 --- a/trunk/arch/parisc/kernel/sys_parisc32.c +++ b/trunk/arch/parisc/kernel/sys_parisc32.c @@ -350,6 +350,10 @@ sys32_getdents (unsigned int fd, void __user * dirent, unsigned int count) struct getdents32_callback buf; int error; + error = -EFAULT; + if (!access_ok(VERIFY_WRITE, dirent, count)) + goto out; + error = -EBADF; file = fget(fd); if (!file) @@ -366,8 +370,10 @@ sys32_getdents (unsigned int fd, void __user * dirent, unsigned int count) error = buf.error; lastdirent = buf.previous; if (lastdirent) { - put_user(file->f_pos, &lastdirent->d_off); - error = count - buf.count; + if (put_user(file->f_pos, &lastdirent->d_off)) + error = -EFAULT; + else + error = count - buf.count; } out_putf: