diff options
author | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2017-06-09 11:19:02 +0200 |
---|---|---|
committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2017-06-09 11:19:02 +0200 |
commit | e0ac3f98254da5304f0a0ffe6f033eb7764644b1 (patch) | |
tree | a592524a0481c63cbb184c5f1d5e0587730fdd4a /drivers/tty/vt | |
parent | 8bc39bca5e3e8da0d62f7f4d67fdbeecab02b350 (diff) | |
parent | f8564c93e0907651e21d586920e629227bb0d024 (diff) | |
download | linux-e0ac3f98254da5304f0a0ffe6f033eb7764644b1.tar.bz2 |
Merge branch 'vt_copy_cleanup' into tty-next
The vt copy_from/to_user cleanups were in a separate branch for others
to work off of.
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/tty/vt')
-rw-r--r-- | drivers/tty/vt/consolemap.c | 56 | ||||
-rw-r--r-- | drivers/tty/vt/vt.c | 6 | ||||
-rw-r--r-- | drivers/tty/vt/vt_ioctl.c | 8 |
3 files changed, 19 insertions, 51 deletions
diff --git a/drivers/tty/vt/consolemap.c b/drivers/tty/vt/consolemap.c index 1f6e17fc3fb0..a5f88cf0f61d 100644 --- a/drivers/tty/vt/consolemap.c +++ b/drivers/tty/vt/consolemap.c @@ -322,15 +322,13 @@ int con_set_trans_old(unsigned char __user * arg) { int i; unsigned short inbuf[E_TABSZ]; + unsigned char ubuf[E_TABSZ]; - if (!access_ok(VERIFY_READ, arg, E_TABSZ)) + if (copy_from_user(ubuf, arg, E_TABSZ)) return -EFAULT; - for (i = 0; i < E_TABSZ ; i++) { - unsigned char uc; - __get_user(uc, arg+i); - inbuf[i] = UNI_DIRECT_BASE | uc; - } + for (i = 0; i < E_TABSZ ; i++) + inbuf[i] = UNI_DIRECT_BASE | ubuf[i]; console_lock(); memcpy(translations[USER_MAP], inbuf, sizeof(inbuf)); @@ -345,9 +343,6 @@ int con_get_trans_old(unsigned char __user * arg) unsigned short *p = translations[USER_MAP]; unsigned char outbuf[E_TABSZ]; - if (!access_ok(VERIFY_WRITE, arg, E_TABSZ)) - return -EFAULT; - console_lock(); for (i = 0; i < E_TABSZ ; i++) { @@ -356,22 +351,16 @@ int con_get_trans_old(unsigned char __user * arg) } console_unlock(); - for (i = 0; i < E_TABSZ ; i++) - __put_user(outbuf[i], arg+i); - return 0; + return copy_to_user(arg, outbuf, sizeof(outbuf)) ? -EFAULT : 0; } int con_set_trans_new(ushort __user * arg) { - int i; unsigned short inbuf[E_TABSZ]; - if (!access_ok(VERIFY_READ, arg, E_TABSZ*sizeof(unsigned short))) + if (copy_from_user(inbuf, arg, sizeof(inbuf))) return -EFAULT; - for (i = 0; i < E_TABSZ ; i++) - __get_user(inbuf[i], arg+i); - console_lock(); memcpy(translations[USER_MAP], inbuf, sizeof(inbuf)); update_user_maps(); @@ -381,19 +370,13 @@ int con_set_trans_new(ushort __user * arg) int con_get_trans_new(ushort __user * arg) { - int i; unsigned short outbuf[E_TABSZ]; - if (!access_ok(VERIFY_WRITE, arg, E_TABSZ*sizeof(unsigned short))) - return -EFAULT; - console_lock(); memcpy(outbuf, translations[USER_MAP], sizeof(outbuf)); console_unlock(); - for (i = 0; i < E_TABSZ ; i++) - __put_user(outbuf[i], arg+i); - return 0; + return copy_to_user(arg, outbuf, sizeof(outbuf)) ? -EFAULT : 0; } /* @@ -557,14 +540,9 @@ int con_set_unimap(struct vc_data *vc, ushort ct, struct unipair __user *list) if (!ct) return 0; - unilist = kmalloc_array(ct, sizeof(struct unipair), GFP_KERNEL); - if (!unilist) - return -ENOMEM; - - for (i = ct, plist = unilist; i; i--, plist++, list++) { - __get_user(plist->unicode, &list->unicode); - __get_user(plist->fontpos, &list->fontpos); - } + unilist = memdup_user(list, ct * sizeof(struct unipair)); + if (IS_ERR(unilist)) + return PTR_ERR(unilist); console_lock(); @@ -757,11 +735,11 @@ EXPORT_SYMBOL(con_copy_unimap); */ int con_get_unimap(struct vc_data *vc, ushort ct, ushort __user *uct, struct unipair __user *list) { - int i, j, k; + int i, j, k, ret = 0; ushort ect; u16 **p1, *p2; struct uni_pagedir *p; - struct unipair *unilist, *plist; + struct unipair *unilist; unilist = kmalloc_array(ct, sizeof(struct unipair), GFP_KERNEL); if (!unilist) @@ -792,13 +770,11 @@ int con_get_unimap(struct vc_data *vc, ushort ct, ushort __user *uct, struct uni } } console_unlock(); - for (i = min(ect, ct), plist = unilist; i; i--, list++, plist++) { - __put_user(plist->unicode, &list->unicode); - __put_user(plist->fontpos, &list->fontpos); - } - __put_user(ect, uct); + if (copy_to_user(list, unilist, min(ect, ct) * sizeof(struct unipair))) + ret = -EFAULT; + put_user(ect, uct); kfree(unilist); - return ((ect <= ct) ? 0 : -ENOMEM); + return ret ? ret : (ect <= ct) ? 0 : -ENOMEM; } /* diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c index 9c9945284bcf..bacc48b0b4b8 100644 --- a/drivers/tty/vt/vt.c +++ b/drivers/tty/vt/vt.c @@ -2709,13 +2709,13 @@ int tioclinux(struct tty_struct *tty, unsigned long arg) * related to the kernel should not use this. */ data = vt_get_shift_state(); - ret = __put_user(data, p); + ret = put_user(data, p); break; case TIOCL_GETMOUSEREPORTING: console_lock(); /* May be overkill */ data = mouse_reporting(); console_unlock(); - ret = __put_user(data, p); + ret = put_user(data, p); break; case TIOCL_SETVESABLANK: console_lock(); @@ -2724,7 +2724,7 @@ int tioclinux(struct tty_struct *tty, unsigned long arg) break; case TIOCL_GETKMSGREDIRECT: data = vt_get_kmsg_redirect(); - ret = __put_user(data, p); + ret = put_user(data, p); break; case TIOCL_SETKMSGREDIRECT: if (!capable(CAP_SYS_ADMIN)) { diff --git a/drivers/tty/vt/vt_ioctl.c b/drivers/tty/vt/vt_ioctl.c index 0cbfe1ff6f6c..96d389cb506c 100644 --- a/drivers/tty/vt/vt_ioctl.c +++ b/drivers/tty/vt/vt_ioctl.c @@ -266,10 +266,6 @@ do_unimap_ioctl(int cmd, struct unimapdesc __user *user_ud, int perm, struct vc_ if (copy_from_user(&tmp, user_ud, sizeof tmp)) return -EFAULT; - if (tmp.entries) - if (!access_ok(VERIFY_WRITE, tmp.entries, - tmp.entry_ct*sizeof(struct unipair))) - return -EFAULT; switch (cmd) { case PIO_UNIMAP: if (!perm) @@ -1170,10 +1166,6 @@ compat_unimap_ioctl(unsigned int cmd, struct compat_unimapdesc __user *user_ud, if (copy_from_user(&tmp, user_ud, sizeof tmp)) return -EFAULT; tmp_entries = compat_ptr(tmp.entries); - if (tmp_entries) - if (!access_ok(VERIFY_WRITE, tmp_entries, - tmp.entry_ct*sizeof(struct unipair))) - return -EFAULT; switch (cmd) { case PIO_UNIMAP: if (!perm) |