FreeBSD: Add error handling for copyin() and copyout() calls

Make sure that ioctls report an error if copyout() fails. Also be sure to verify that copyin() succeeds, lest we proceed blindly with whatever was previously in the destination buffer.
OpenCBM · Jan 3, 2024 · db80d1b · db80d1b
1 parent c415087
commit db80d1b
Showing 1 changed file with 5 additions and 3 deletions.
diff --git a/opencbm/sys/freebsd/opencbm.c b/opencbm/sys/freebsd/opencbm.c
@@ -697,7 +697,7 @@ cbm_ioctl(struct cdev *dev, u_long cmd, caddr_t data, int fflag,
                     break;
                 }
                 rv = !cbm_parallel_burst_read_track(sc, ppbus, sc->sc_buf);
-                if (!rv) copyout(sc->sc_buf, val->buffer, BUFFER_SIZE);
+                if (!rv) rv = copyout(sc->sc_buf, val->buffer, BUFFER_SIZE);
                 break;
 
         case CBMCTRL_PARBURST_READ_TRACK_VAR:
@@ -708,7 +708,7 @@ cbm_ioctl(struct cdev *dev, u_long cmd, caddr_t data, int fflag,
                     break;
                 }
                 rv = !cbm_parallel_burst_read_track_var(sc, ppbus, sc->sc_buf);
-                if (!rv) copyout(sc->sc_buf, val->buffer, BUFFER_SIZE);
+                if (!rv) rv = copyout(sc->sc_buf, val->buffer, BUFFER_SIZE);
                 break;
 
         case CBMCTRL_PARBURST_WRITE_TRACK:
@@ -718,7 +718,9 @@ cbm_ioctl(struct cdev *dev, u_long cmd, caddr_t data, int fflag,
                     rv = EINVAL;
                     break;
                 }
-                copyin(val->buffer, sc->sc_buf, val->length);
+                rv = copyin(val->buffer, sc->sc_buf, val->length);
+                if (rv)
+                    break;
                 rv = !cbm_parallel_burst_write_track(sc, ppbus,
                         val->buffer, val->length);
                 break;