aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/char/rio
diff options
context:
space:
mode:
authorAl Viro <viro@zeniv.linux.org.uk>2006-05-27 02:11:12 -0400
committerAl Viro <viro@zeniv.linux.org.uk>2006-05-27 02:27:15 -0400
commit0645819196b5029936cf07a8ba27860e0d45c8d9 (patch)
tree4691984b5c51c8315af84f2762c39a106216c5bb /drivers/char/rio
parent6bc540e69a6376b9d58d8490f4998da9e45e2746 (diff)
[PATCH] copy_to_user() from iomem is a bad thing
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Diffstat (limited to 'drivers/char/rio')
-rw-r--r--drivers/char/rio/rioctrl.c20
1 files changed, 16 insertions, 4 deletions
diff --git a/drivers/char/rio/rioctrl.c b/drivers/char/rio/rioctrl.c
index caeae5b774b3..052e8120a471 100644
--- a/drivers/char/rio/rioctrl.c
+++ b/drivers/char/rio/rioctrl.c
@@ -126,6 +126,18 @@ static int
126 126
127#define drv_makedev(maj, min) ((((uint) maj & 0xff) << 8) | ((uint) min & 0xff)) 127#define drv_makedev(maj, min) ((((uint) maj & 0xff) << 8) | ((uint) min & 0xff))
128 128
129static int copy_from_io(void __user *to, void __iomem *from, size_t size)
130{
131 void *buf = kmalloc(size, GFP_KERNEL);
132 int res = -ENOMEM;
133 if (buf) {
134 rio_memcpy_fromio(buf, from, size);
135 res = copy_to_user(to, buf, size);
136 kfree(buf);
137 }
138 return res;
139}
140
129int riocontrol(struct rio_info *p, dev_t dev, int cmd, unsigned long arg, int su) 141int riocontrol(struct rio_info *p, dev_t dev, int cmd, unsigned long arg, int su)
130{ 142{
131 uint Host; /* leave me unsigned! */ 143 uint Host; /* leave me unsigned! */
@@ -893,7 +905,7 @@ int riocontrol(struct rio_info *p, dev_t dev, int cmd, unsigned long arg, int su
893 ** Fetch the parmmap 905 ** Fetch the parmmap
894 */ 906 */
895 rio_dprintk(RIO_DEBUG_CTRL, "RIO_PARMS\n"); 907 rio_dprintk(RIO_DEBUG_CTRL, "RIO_PARMS\n");
896 if (copy_to_user(argp, p->RIOHosts[host].ParmMapP, sizeof(PARM_MAP))) { 908 if (copy_from_io(argp, p->RIOHosts[host].ParmMapP, sizeof(PARM_MAP))) {
897 p->RIOError.Error = COPYOUT_FAILED; 909 p->RIOError.Error = COPYOUT_FAILED;
898 rio_dprintk(RIO_DEBUG_CTRL, "RIO_PARMS: Copy out to user space failed\n"); 910 rio_dprintk(RIO_DEBUG_CTRL, "RIO_PARMS: Copy out to user space failed\n");
899 return -EFAULT; 911 return -EFAULT;
@@ -947,7 +959,7 @@ int riocontrol(struct rio_info *p, dev_t dev, int cmd, unsigned long arg, int su
947 rio_dprintk(RIO_DEBUG_CTRL, "RIO_HOST_DPRAM: Bad copy to user space\n"); 959 rio_dprintk(RIO_DEBUG_CTRL, "RIO_HOST_DPRAM: Bad copy to user space\n");
948 return -EFAULT; 960 return -EFAULT;
949 } 961 }
950 } else if (copy_to_user(HostDpRam.DpRamP, p->RIOHosts[HostDpRam.HostNum].Caddr, sizeof(struct DpRam))) { 962 } else if (copy_from_io(HostDpRam.DpRamP, p->RIOHosts[HostDpRam.HostNum].Caddr, sizeof(struct DpRam))) {
951 p->RIOError.Error = COPYOUT_FAILED; 963 p->RIOError.Error = COPYOUT_FAILED;
952 rio_dprintk(RIO_DEBUG_CTRL, "RIO_HOST_DPRAM: Bad copy to user space\n"); 964 rio_dprintk(RIO_DEBUG_CTRL, "RIO_HOST_DPRAM: Bad copy to user space\n");
953 return -EFAULT; 965 return -EFAULT;
@@ -1021,7 +1033,7 @@ int riocontrol(struct rio_info *p, dev_t dev, int cmd, unsigned long arg, int su
1021 } 1033 }
1022 rio_dprintk(RIO_DEBUG_CTRL, "Request for rup %d from host %d\n", RupReq.RupNum, RupReq.HostNum); 1034 rio_dprintk(RIO_DEBUG_CTRL, "Request for rup %d from host %d\n", RupReq.RupNum, RupReq.HostNum);
1023 1035
1024 if (copy_to_user(RupReq.RupP, HostP->UnixRups[RupReq.RupNum].RupP, sizeof(struct RUP))) { 1036 if (copy_from_io(RupReq.RupP, HostP->UnixRups[RupReq.RupNum].RupP, sizeof(struct RUP))) {
1025 p->RIOError.Error = COPYOUT_FAILED; 1037 p->RIOError.Error = COPYOUT_FAILED;
1026 rio_dprintk(RIO_DEBUG_CTRL, "RIO_HOST_RUP: Bad copy to user space\n"); 1038 rio_dprintk(RIO_DEBUG_CTRL, "RIO_HOST_RUP: Bad copy to user space\n");
1027 return -EFAULT; 1039 return -EFAULT;
@@ -1058,7 +1070,7 @@ int riocontrol(struct rio_info *p, dev_t dev, int cmd, unsigned long arg, int su
1058 } 1070 }
1059 rio_dprintk(RIO_DEBUG_CTRL, "Request for lpb %d from host %d\n", LpbReq.Link, LpbReq.Host); 1071 rio_dprintk(RIO_DEBUG_CTRL, "Request for lpb %d from host %d\n", LpbReq.Link, LpbReq.Host);
1060 1072
1061 if (copy_to_user(LpbReq.LpbP, &HostP->LinkStrP[LpbReq.Link], sizeof(struct LPB))) { 1073 if (copy_from_io(LpbReq.LpbP, &HostP->LinkStrP[LpbReq.Link], sizeof(struct LPB))) {
1062 rio_dprintk(RIO_DEBUG_CTRL, "RIO_HOST_LPB: Bad copy to user space\n"); 1074 rio_dprintk(RIO_DEBUG_CTRL, "RIO_HOST_LPB: Bad copy to user space\n");
1063 p->RIOError.Error = COPYOUT_FAILED; 1075 p->RIOError.Error = COPYOUT_FAILED;
1064 return -EFAULT; 1076 return -EFAULT;