floppy: Add an extra bound check on ioctl arguments

[net-next-2.6.git] / drivers / block / floppy.c

diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index d41d7f018549863391bed8adbca97ecdb3bdca20..3266b4f65daa37dec3110ff2220f8d4b7c1bfb42 100644 (file)
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -3497,6 +3497,9 @@ static int fd_ioctl(struct block_device *bdev, fmode_t mode, unsigned int cmd,
            ((cmd & 0x80) && !capable(CAP_SYS_ADMIN)))
                return -EPERM;
 
+       if (WARN_ON(size < 0 || size > sizeof(inparam)))
+               return -EINVAL;
+
        /* copyin */
        CLEARSTRUCT(&inparam);
        if (_IOC_DIR(cmd) & _IOC_WRITE)