350 	struct ax25_ctl_struct ax25_ctl;  in ax25_ctl_ioctl()  local
357 	if (copy_from_user(&ax25_ctl, arg, sizeof(ax25_ctl)))  in ax25_ctl_ioctl()
360 	if ((ax25_dev = ax25_addr_ax25dev(&ax25_ctl.port_addr)) == NULL)  in ax25_ctl_ioctl()
363 	if (ax25_ctl.digi_count > AX25_MAX_DIGIS)  in ax25_ctl_ioctl()
366 	if (ax25_ctl.arg > ULONG_MAX / HZ && ax25_ctl.cmd != AX25_KILL)  in ax25_ctl_ioctl()
369 	digi.ndigi = ax25_ctl.digi_count;  in ax25_ctl_ioctl()
371 		digi.calls[k] = ax25_ctl.digi_addr[k];  in ax25_ctl_ioctl()
373 …if ((ax25 = ax25_find_cb(&ax25_ctl.source_addr, &ax25_ctl.dest_addr, &digi, ax25_dev->dev)) == NUL…  in ax25_ctl_ioctl()
376 	switch (ax25_ctl.cmd) {  in ax25_ctl_ioctl()
388 			if (ax25_ctl.arg < 1 || ax25_ctl.arg > 7)  in ax25_ctl_ioctl()
391 			if (ax25_ctl.arg < 1 || ax25_ctl.arg > 63)  in ax25_ctl_ioctl()
394 		ax25->window = ax25_ctl.arg;  in ax25_ctl_ioctl()
398 		if (ax25_ctl.arg < 1 || ax25_ctl.arg > ULONG_MAX / HZ)  in ax25_ctl_ioctl()
400 		ax25->rtt = (ax25_ctl.arg * HZ) / 2;  in ax25_ctl_ioctl()
401 		ax25->t1  = ax25_ctl.arg * HZ;  in ax25_ctl_ioctl()
405 		if (ax25_ctl.arg < 1 || ax25_ctl.arg > ULONG_MAX / HZ)  in ax25_ctl_ioctl()
407 		ax25->t2 = ax25_ctl.arg * HZ;  in ax25_ctl_ioctl()
411 		if (ax25_ctl.arg < 1 || ax25_ctl.arg > 31)  in ax25_ctl_ioctl()
414 		ax25->n2 = ax25_ctl.arg;  in ax25_ctl_ioctl()
418 		if (ax25_ctl.arg > ULONG_MAX / HZ)  in ax25_ctl_ioctl()
420 		ax25->t3 = ax25_ctl.arg * HZ;  in ax25_ctl_ioctl()
424 		if (ax25_ctl.arg > ULONG_MAX / (60 * HZ))  in ax25_ctl_ioctl()
427 		ax25->idle = ax25_ctl.arg * 60 * HZ;  in ax25_ctl_ioctl()
431 		if (ax25_ctl.arg < 16 || ax25_ctl.arg > 65535)  in ax25_ctl_ioctl()
433 		ax25->paclen = ax25_ctl.arg;  in ax25_ctl_ioctl()