applicom: Fix an unchecked user ioctl range and an error return

commit a7be18d436f0c7007794965e5af29fa1ffff1e05 upstream.

Closes bug #11408 by checking the card index range for command 0
Fixes the ioctl to return ENOTTY which is correct for unknown ioctls

Signed-off-by: Alan Cox <alan@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

diff --git a/drivers/char/applicom.c b/drivers/char/applicom.c
index 31d08b641f5be84667c5d53e49c862915e65d0c8..b899d9182c7dec0b0b03e2857b680a30806cf12e 100644 (file)
--- a/drivers/char/applicom.c
+++ b/drivers/char/applicom.c
@@ -712,8 +712,7 @@ static int ac_ioctl(struct inode *inode, struct file *file, unsigned int cmd, un
        
        IndexCard = adgl->num_card-1;
         
-       if(cmd != 0 && cmd != 6 &&
-          ((IndexCard >= MAX_BOARD) || !apbs[IndexCard].RamIO)) {
+       if(cmd != 6 && ((IndexCard >= MAX_BOARD) || !apbs[IndexCard].RamIO)) {
                static int warncount = 10;
                if (warncount) {
                        printk( KERN_WARNING "APPLICOM driver IOCTL, bad board number %d\n",(int)IndexCard+1);
@@ -832,8 +831,7 @@ static int ac_ioctl(struct inode *inode, struct file *file, unsigned int cmd, un
                }
                break;
        default:
-               printk(KERN_INFO "APPLICOM driver ioctl, unknown function code %d\n",cmd) ;
-               ret = -EINVAL;
+               ret = -ENOTTY;
                break;
        }
        Dummy = readb(apbs[IndexCard].RamIO + VERS);