From 084b6e7765b9554699afa23a50e702a3d0ae4b24 Mon Sep 17 00:00:00 2001
From: =?utf8?q?Salva=20Peir=C3=B3?= <speiro@ai2.upv.es>
Date: Mon, 3 Mar 2014 08:44:04 +0100
Subject: [PATCH] staging/cxt1e1/linux.c: Correct arbitrary memory write in
 c4_ioctl()
MIME-Version: 1.0
Content-Type: text/plain; charset=utf8
Content-Transfer-Encoding: 8bit

The function c4_ioctl() writes data from user in ifr->ifr_data
to the kernel struct data arg, without any iolen bounds checking.
This can lead to a arbitrary write outside of the struct data arg.
Corrected by adding bounds-checking of iolen before the copy_from_user().

Signed-off-by: Salva Peiró <speiro@ai2.upv.es>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Reading git-format-patch failed