[SPARC]: Fix length parameter verification in sys_getdomainname().

Found by scrashme.

Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/arch/sparc/kernel/sys_sparc.c b/arch/sparc/kernel/sys_sparc.c
index 0cdfc9d294b45a777b20ec249ed79094862b650f..a41c8a5c20070847a037a8b73ef4e7bcda0a53b4 100644 (file)
--- a/arch/sparc/kernel/sys_sparc.c
+++ b/arch/sparc/kernel/sys_sparc.c
@@ -465,21 +465,21 @@ sys_rt_sigaction(int sig,
 
 asmlinkage int sys_getdomainname(char __user *name, int len)
 {
-       int nlen;
-       int err = -EFAULT;
+       int nlen, err;
        
+       if (len < 0 || len > __NEW_UTS_LEN)
+               return -EINVAL;
+
        down_read(&uts_sem);
        
        nlen = strlen(system_utsname.domainname) + 1;
-
        if (nlen < len)
                len = nlen;
-       if (len > __NEW_UTS_LEN)
-               goto done;
-       if (copy_to_user(name, system_utsname.domainname, len))
-               goto done;
-       err = 0;
-done:
+
+       err = -EFAULT;
+       if (!copy_to_user(name, system_utsname.domainname, len))
+               err = 0;
+
        up_read(&uts_sem);
        return err;
 }

diff --git a/arch/sparc64/kernel/sys_sparc.c b/arch/sparc64/kernel/sys_sparc.c
index 51c056df528eb2f1f7a1687bfc8a4e172fa2952a..054d0abdb7eef49ad2db9f0a8eea114029dc7a94 100644 (file)
--- a/arch/sparc64/kernel/sys_sparc.c
+++ b/arch/sparc64/kernel/sys_sparc.c
@@ -701,21 +701,21 @@ extern void check_pending(int signum);
 
 asmlinkage long sys_getdomainname(char __user *name, int len)
 {
-        int nlen;
-       int err = -EFAULT;
+        int nlen, err;
+
+       if (len < 0 || len > __NEW_UTS_LEN)
+               return -EINVAL;
 
        down_read(&uts_sem);
        
        nlen = strlen(system_utsname.domainname) + 1;
-
         if (nlen < len)
                 len = nlen;
-       if (len > __NEW_UTS_LEN)
-               goto done;
-       if (copy_to_user(name, system_utsname.domainname, len))
-               goto done;
-       err = 0;
-done:
+
+       err = -EFAULT;
+       if (!copy_to_user(name, system_utsname.domainname, len))
+               err = 0;
+
        up_read(&uts_sem);
        return err;
 }