func: static CVE_2007_6151_VULN_isdn_ioctl(struct inode *inode, struct file *file, uint cmd, ulong arg) uint minor = iminor ( inode ) ; char __user * p ; void __user * argp = ( void __user * ) arg ; if ( minor == ISDN_MINOR_STATUS )  if ( ! dev -> drivers )  if ( minor <= ISDN_MINOR_BMAX )  if ( minor <= ISDN_MINOR_CTRLMAX )  switch ( cmd )  if ( arg )  char * p ; if ( copy_from_user ( & iocts , argp , sizeof ( isdn_ioctl_struct ) ) )  if ( strlen ( iocts . drvid ) )  if ( p = strchr ( iocts . drvid , ',' ) )  * p = 0; if ( copy_to_user ( p , dev -> mdm . info [ i ] . emu . profile , ISDN_MODEM_NUMREG ) )  p += ISDN_MODEM_NUMREG; if ( copy_to_user ( p , dev -> mdm . info [ i ] . emu . pmsn , ISDN_MSNLEN ) )  p += ISDN_MSNLEN; if ( copy_to_user ( p , dev -> mdm . info [ i ] . emu . plmsn , ISDN_LMSNLEN ) )  p += ISDN_LMSNLEN; if ( copy_from_user ( dev -> mdm . info [ i ] . emu . profile , p , ISDN_MODEM_NUMREG ) )  p += ISDN_MODEM_NUMREG; if ( copy_from_user ( dev -> mdm . info [ i ] . emu . plmsn , p , ISDN_LMSNLEN ) )  p += ISDN_LMSNLEN; if ( copy_from_user ( dev -> mdm . info [ i ] . emu . pmsn , p , ISDN_MSNLEN ) )  p += ISDN_MSNLEN; if ( ! access_ok ( VERIFY_READ , p , 1 ) )  get_user ( bname [ j ] , p ++ ); 