diff options
author | Al Viro <viro@zeniv.linux.org.uk> | 2006-05-27 02:11:12 -0400 |
---|---|---|
committer | Al Viro <viro@zeniv.linux.org.uk> | 2006-05-27 02:27:15 -0400 |
commit | 0645819196b5029936cf07a8ba27860e0d45c8d9 (patch) | |
tree | 4691984b5c51c8315af84f2762c39a106216c5bb /drivers/char/rio/rioctrl.c | |
parent | 6bc540e69a6376b9d58d8490f4998da9e45e2746 (diff) |
[PATCH] copy_to_user() from iomem is a bad thing
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Diffstat (limited to 'drivers/char/rio/rioctrl.c')
-rw-r--r-- | drivers/char/rio/rioctrl.c | 20 |
1 files changed, 16 insertions, 4 deletions
diff --git a/drivers/char/rio/rioctrl.c b/drivers/char/rio/rioctrl.c index caeae5b774b3..052e8120a471 100644 --- a/drivers/char/rio/rioctrl.c +++ b/drivers/char/rio/rioctrl.c | |||
@@ -126,6 +126,18 @@ static int | |||
126 | 126 | ||
127 | #define drv_makedev(maj, min) ((((uint) maj & 0xff) << 8) | ((uint) min & 0xff)) | 127 | #define drv_makedev(maj, min) ((((uint) maj & 0xff) << 8) | ((uint) min & 0xff)) |
128 | 128 | ||
129 | static int copy_from_io(void __user *to, void __iomem *from, size_t size) | ||
130 | { | ||
131 | void *buf = kmalloc(size, GFP_KERNEL); | ||
132 | int res = -ENOMEM; | ||
133 | if (buf) { | ||
134 | rio_memcpy_fromio(buf, from, size); | ||
135 | res = copy_to_user(to, buf, size); | ||
136 | kfree(buf); | ||
137 | } | ||
138 | return res; | ||
139 | } | ||
140 | |||
129 | int riocontrol(struct rio_info *p, dev_t dev, int cmd, unsigned long arg, int su) | 141 | int riocontrol(struct rio_info *p, dev_t dev, int cmd, unsigned long arg, int su) |
130 | { | 142 | { |
131 | uint Host; /* leave me unsigned! */ | 143 | uint Host; /* leave me unsigned! */ |
@@ -893,7 +905,7 @@ int riocontrol(struct rio_info *p, dev_t dev, int cmd, unsigned long arg, int su | |||
893 | ** Fetch the parmmap | 905 | ** Fetch the parmmap |
894 | */ | 906 | */ |
895 | rio_dprintk(RIO_DEBUG_CTRL, "RIO_PARMS\n"); | 907 | rio_dprintk(RIO_DEBUG_CTRL, "RIO_PARMS\n"); |
896 | if (copy_to_user(argp, p->RIOHosts[host].ParmMapP, sizeof(PARM_MAP))) { | 908 | if (copy_from_io(argp, p->RIOHosts[host].ParmMapP, sizeof(PARM_MAP))) { |
897 | p->RIOError.Error = COPYOUT_FAILED; | 909 | p->RIOError.Error = COPYOUT_FAILED; |
898 | rio_dprintk(RIO_DEBUG_CTRL, "RIO_PARMS: Copy out to user space failed\n"); | 910 | rio_dprintk(RIO_DEBUG_CTRL, "RIO_PARMS: Copy out to user space failed\n"); |
899 | return -EFAULT; | 911 | return -EFAULT; |
@@ -947,7 +959,7 @@ int riocontrol(struct rio_info *p, dev_t dev, int cmd, unsigned long arg, int su | |||
947 | rio_dprintk(RIO_DEBUG_CTRL, "RIO_HOST_DPRAM: Bad copy to user space\n"); | 959 | rio_dprintk(RIO_DEBUG_CTRL, "RIO_HOST_DPRAM: Bad copy to user space\n"); |
948 | return -EFAULT; | 960 | return -EFAULT; |
949 | } | 961 | } |
950 | } else if (copy_to_user(HostDpRam.DpRamP, p->RIOHosts[HostDpRam.HostNum].Caddr, sizeof(struct DpRam))) { | 962 | } else if (copy_from_io(HostDpRam.DpRamP, p->RIOHosts[HostDpRam.HostNum].Caddr, sizeof(struct DpRam))) { |
951 | p->RIOError.Error = COPYOUT_FAILED; | 963 | p->RIOError.Error = COPYOUT_FAILED; |
952 | rio_dprintk(RIO_DEBUG_CTRL, "RIO_HOST_DPRAM: Bad copy to user space\n"); | 964 | rio_dprintk(RIO_DEBUG_CTRL, "RIO_HOST_DPRAM: Bad copy to user space\n"); |
953 | return -EFAULT; | 965 | return -EFAULT; |
@@ -1021,7 +1033,7 @@ int riocontrol(struct rio_info *p, dev_t dev, int cmd, unsigned long arg, int su | |||
1021 | } | 1033 | } |
1022 | rio_dprintk(RIO_DEBUG_CTRL, "Request for rup %d from host %d\n", RupReq.RupNum, RupReq.HostNum); | 1034 | rio_dprintk(RIO_DEBUG_CTRL, "Request for rup %d from host %d\n", RupReq.RupNum, RupReq.HostNum); |
1023 | 1035 | ||
1024 | if (copy_to_user(RupReq.RupP, HostP->UnixRups[RupReq.RupNum].RupP, sizeof(struct RUP))) { | 1036 | if (copy_from_io(RupReq.RupP, HostP->UnixRups[RupReq.RupNum].RupP, sizeof(struct RUP))) { |
1025 | p->RIOError.Error = COPYOUT_FAILED; | 1037 | p->RIOError.Error = COPYOUT_FAILED; |
1026 | rio_dprintk(RIO_DEBUG_CTRL, "RIO_HOST_RUP: Bad copy to user space\n"); | 1038 | rio_dprintk(RIO_DEBUG_CTRL, "RIO_HOST_RUP: Bad copy to user space\n"); |
1027 | return -EFAULT; | 1039 | return -EFAULT; |
@@ -1058,7 +1070,7 @@ int riocontrol(struct rio_info *p, dev_t dev, int cmd, unsigned long arg, int su | |||
1058 | } | 1070 | } |
1059 | rio_dprintk(RIO_DEBUG_CTRL, "Request for lpb %d from host %d\n", LpbReq.Link, LpbReq.Host); | 1071 | rio_dprintk(RIO_DEBUG_CTRL, "Request for lpb %d from host %d\n", LpbReq.Link, LpbReq.Host); |
1060 | 1072 | ||
1061 | if (copy_to_user(LpbReq.LpbP, &HostP->LinkStrP[LpbReq.Link], sizeof(struct LPB))) { | 1073 | if (copy_from_io(LpbReq.LpbP, &HostP->LinkStrP[LpbReq.Link], sizeof(struct LPB))) { |
1062 | rio_dprintk(RIO_DEBUG_CTRL, "RIO_HOST_LPB: Bad copy to user space\n"); | 1074 | rio_dprintk(RIO_DEBUG_CTRL, "RIO_HOST_LPB: Bad copy to user space\n"); |
1063 | p->RIOError.Error = COPYOUT_FAILED; | 1075 | p->RIOError.Error = COPYOUT_FAILED; |
1064 | return -EFAULT; | 1076 | return -EFAULT; |