Merge branch 'work.__copy_in_user' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
Pull __copy_in_user removal from Al Viro: "There used to be 6 places in the entire tree calling __copy_in_user(), all of them bogus. Four got killed off in work.drm branch, this takes care of the remaining ones and kills the definition of that sucker" * 'work.__copy_in_user' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: kill __copy_in_user() sanitize do_i2c_smbus_ioctl()
This commit is contained in:
commit
46ace66b3b
2 changed files with 9 additions and 16 deletions
|
@ -739,23 +739,22 @@ static int do_i2c_smbus_ioctl(struct file *file,
|
|||
unsigned int cmd, struct i2c_smbus_ioctl_data32 __user *udata)
|
||||
{
|
||||
struct i2c_smbus_ioctl_data __user *tdata;
|
||||
compat_caddr_t datap;
|
||||
union {
|
||||
/* beginnings of those have identical layouts */
|
||||
struct i2c_smbus_ioctl_data32 data32;
|
||||
struct i2c_smbus_ioctl_data data;
|
||||
} v;
|
||||
|
||||
tdata = compat_alloc_user_space(sizeof(*tdata));
|
||||
if (tdata == NULL)
|
||||
return -ENOMEM;
|
||||
if (!access_ok(VERIFY_WRITE, tdata, sizeof(*tdata)))
|
||||
return -EFAULT;
|
||||
|
||||
if (!access_ok(VERIFY_READ, udata, sizeof(*udata)))
|
||||
memset(&v, 0, sizeof(v));
|
||||
if (copy_from_user(&v.data32, udata, sizeof(v.data32)))
|
||||
return -EFAULT;
|
||||
v.data.data = compat_ptr(v.data32.data);
|
||||
|
||||
if (__copy_in_user(&tdata->read_write, &udata->read_write, 2 * sizeof(u8)))
|
||||
return -EFAULT;
|
||||
if (__copy_in_user(&tdata->size, &udata->size, 2 * sizeof(u32)))
|
||||
return -EFAULT;
|
||||
if (__get_user(datap, &udata->data) ||
|
||||
__put_user(compat_ptr(datap), &tdata->data))
|
||||
if (copy_to_user(tdata, &v.data, sizeof(v.data)))
|
||||
return -EFAULT;
|
||||
|
||||
return do_ioctl(file, cmd, (unsigned long)tdata);
|
||||
|
|
|
@ -156,12 +156,6 @@ copy_to_user(void __user *to, const void *from, unsigned long n)
|
|||
}
|
||||
#ifdef CONFIG_COMPAT
|
||||
static __always_inline unsigned long __must_check
|
||||
__copy_in_user(void __user *to, const void *from, unsigned long n)
|
||||
{
|
||||
might_fault();
|
||||
return raw_copy_in_user(to, from, n);
|
||||
}
|
||||
static __always_inline unsigned long __must_check
|
||||
copy_in_user(void __user *to, const void *from, unsigned long n)
|
||||
{
|
||||
might_fault();
|
||||
|
|
Loading…
Reference in a new issue