diff options
author | Dan Carpenter <dan.carpenter@oracle.com> | 2018-10-08 06:57:36 -0400 |
---|---|---|
committer | Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com> | 2018-10-08 06:57:36 -0400 |
commit | d8bad911e5e55e228d59c0606ff7e6b8131ca7bf (patch) | |
tree | d0b97807fce4972f4bbc08f859fd2ec9ede12c5e | |
parent | 5c63e407aaabb0464236cfc6279a2d79aede7073 (diff) |
fbdev: sbuslib: use checked version of put_user()
I'm not sure why the code assumes that only the first put_user() needs
an access_ok() check. I have made all the put_user() and get_user()
calls checked.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Philippe Ombredanne <pombredanne@nexb.com>
Cc: Mathieu Malaterre <malat@debian.org>
Cc: Peter Malone <peter.malone@gmail.com>,
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
-rw-r--r-- | drivers/video/fbdev/sbuslib.c | 26 |
1 files changed, 13 insertions, 13 deletions
diff --git a/drivers/video/fbdev/sbuslib.c b/drivers/video/fbdev/sbuslib.c index a436d44f1b7f..90c51330969c 100644 --- a/drivers/video/fbdev/sbuslib.c +++ b/drivers/video/fbdev/sbuslib.c | |||
@@ -106,11 +106,11 @@ int sbusfb_ioctl_helper(unsigned long cmd, unsigned long arg, | |||
106 | struct fbtype __user *f = (struct fbtype __user *) arg; | 106 | struct fbtype __user *f = (struct fbtype __user *) arg; |
107 | 107 | ||
108 | if (put_user(type, &f->fb_type) || | 108 | if (put_user(type, &f->fb_type) || |
109 | __put_user(info->var.yres, &f->fb_height) || | 109 | put_user(info->var.yres, &f->fb_height) || |
110 | __put_user(info->var.xres, &f->fb_width) || | 110 | put_user(info->var.xres, &f->fb_width) || |
111 | __put_user(fb_depth, &f->fb_depth) || | 111 | put_user(fb_depth, &f->fb_depth) || |
112 | __put_user(0, &f->fb_cmsize) || | 112 | put_user(0, &f->fb_cmsize) || |
113 | __put_user(fb_size, &f->fb_cmsize)) | 113 | put_user(fb_size, &f->fb_cmsize)) |
114 | return -EFAULT; | 114 | return -EFAULT; |
115 | return 0; | 115 | return 0; |
116 | } | 116 | } |
@@ -125,10 +125,10 @@ int sbusfb_ioctl_helper(unsigned long cmd, unsigned long arg, | |||
125 | unsigned int index, count, i; | 125 | unsigned int index, count, i; |
126 | 126 | ||
127 | if (get_user(index, &c->index) || | 127 | if (get_user(index, &c->index) || |
128 | __get_user(count, &c->count) || | 128 | get_user(count, &c->count) || |
129 | __get_user(ured, &c->red) || | 129 | get_user(ured, &c->red) || |
130 | __get_user(ugreen, &c->green) || | 130 | get_user(ugreen, &c->green) || |
131 | __get_user(ublue, &c->blue)) | 131 | get_user(ublue, &c->blue)) |
132 | return -EFAULT; | 132 | return -EFAULT; |
133 | 133 | ||
134 | cmap.len = 1; | 134 | cmap.len = 1; |
@@ -165,10 +165,10 @@ int sbusfb_ioctl_helper(unsigned long cmd, unsigned long arg, | |||
165 | u8 red, green, blue; | 165 | u8 red, green, blue; |
166 | 166 | ||
167 | if (get_user(index, &c->index) || | 167 | if (get_user(index, &c->index) || |
168 | __get_user(count, &c->count) || | 168 | get_user(count, &c->count) || |
169 | __get_user(ured, &c->red) || | 169 | get_user(ured, &c->red) || |
170 | __get_user(ugreen, &c->green) || | 170 | get_user(ugreen, &c->green) || |
171 | __get_user(ublue, &c->blue)) | 171 | get_user(ublue, &c->blue)) |
172 | return -EFAULT; | 172 | return -EFAULT; |
173 | 173 | ||
174 | if (index + count > cmap->len) | 174 | if (index + count > cmap->len) |