diff options
author | Heiko Carstens <heiko.carstens@de.ibm.com> | 2014-02-24 10:18:55 -0500 |
---|---|---|
committer | Martin Schwidefsky <schwidefsky@de.ibm.com> | 2014-02-24 11:14:00 -0500 |
commit | 823002023da6d9124ed63bc622267c15ab2a7347 (patch) | |
tree | cd2b74ff1b6844cca9821d63dfd7180b0a452c06 | |
parent | 9499934f70deac0cdb96aa2d90f2a0a2de69d80c (diff) |
s390/uaccess: remove copy_from_user_real()
There is no user left, so remove it.
It was also potentially broken, since the function didn't clear destination
memory if copy_from_user() failed. Which would allow for information leaks.
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
-rw-r--r-- | arch/s390/include/asm/uaccess.h | 1 | ||||
-rw-r--r-- | arch/s390/mm/maccess.c | 26 |
2 files changed, 0 insertions, 27 deletions
diff --git a/arch/s390/include/asm/uaccess.h b/arch/s390/include/asm/uaccess.h index 2710b41eed22..4133b3f72fb0 100644 --- a/arch/s390/include/asm/uaccess.h +++ b/arch/s390/include/asm/uaccess.h | |||
@@ -344,6 +344,5 @@ static inline unsigned long __must_check clear_user(void __user *to, unsigned lo | |||
344 | } | 344 | } |
345 | 345 | ||
346 | int copy_to_user_real(void __user *dest, void *src, unsigned long count); | 346 | int copy_to_user_real(void __user *dest, void *src, unsigned long count); |
347 | int copy_from_user_real(void *dest, void __user *src, unsigned long count); | ||
348 | 347 | ||
349 | #endif /* __S390_UACCESS_H */ | 348 | #endif /* __S390_UACCESS_H */ |
diff --git a/arch/s390/mm/maccess.c b/arch/s390/mm/maccess.c index efe8ad045c7b..2a2e35416d2f 100644 --- a/arch/s390/mm/maccess.c +++ b/arch/s390/mm/maccess.c | |||
@@ -152,32 +152,6 @@ out: | |||
152 | } | 152 | } |
153 | 153 | ||
154 | /* | 154 | /* |
155 | * Copy memory from user (virtual) to kernel (real) | ||
156 | */ | ||
157 | int copy_from_user_real(void *dest, void __user *src, unsigned long count) | ||
158 | { | ||
159 | int offs = 0, size, rc; | ||
160 | char *buf; | ||
161 | |||
162 | buf = (char *) __get_free_page(GFP_KERNEL); | ||
163 | if (!buf) | ||
164 | return -ENOMEM; | ||
165 | rc = -EFAULT; | ||
166 | while (offs < count) { | ||
167 | size = min(PAGE_SIZE, count - offs); | ||
168 | if (copy_from_user(buf, src + offs, size)) | ||
169 | goto out; | ||
170 | if (memcpy_real(dest + offs, buf, size)) | ||
171 | goto out; | ||
172 | offs += size; | ||
173 | } | ||
174 | rc = 0; | ||
175 | out: | ||
176 | free_page((unsigned long) buf); | ||
177 | return rc; | ||
178 | } | ||
179 | |||
180 | /* | ||
181 | * Check if physical address is within prefix or zero page | 155 | * Check if physical address is within prefix or zero page |
182 | */ | 156 | */ |
183 | static int is_swapped(unsigned long addr) | 157 | static int is_swapped(unsigned long addr) |