aboutsummaryrefslogtreecommitdiffstats
path: root/drivers
diff options
context:
space:
mode:
authorPeter Osterlund <petero2@telia.com>2005-05-14 03:58:30 -0400
committerGreg KH <gregkh@suse.de>2005-05-17 00:07:31 -0400
commit118326e940bdecef6c459d42ccf05256ba86daa7 (patch)
tree13b1e48f4f3700603ed258c41e9e39978babf5ee /drivers
parent68f66feb300423bb9ee5daecb1951af394425a38 (diff)
[PATCH] Fix root hole in pktcdvd
ioctl_by_bdev may only be used INSIDE the kernel. If the "arg" argument refers to memory that is accessed by put_user/get_user in the ioctl function, the memory needs to be in the kernel address space (that's the set_fs(KERNEL_DS) doing in the ioctl_by_bdev). This works on i386 because even with set_fs(KERNEL_DS) the user space memory is still accessible with put_user/get_user. That is not true for s390. In short the ioctl implementation of the pktcdvd device driver is horribly broken. Signed-off-by: Peter Osterlund <petero2@telia.com> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'drivers')
-rw-r--r--drivers/block/pktcdvd.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/block/pktcdvd.c b/drivers/block/pktcdvd.c
index 1a1fa3ccb913..82ccad0a7f1a 100644
--- a/drivers/block/pktcdvd.c
+++ b/drivers/block/pktcdvd.c
@@ -2406,7 +2406,7 @@ static int pkt_ioctl(struct inode *inode, struct file *file, unsigned int cmd, u
2406 case CDROM_LAST_WRITTEN: 2406 case CDROM_LAST_WRITTEN:
2407 case CDROM_SEND_PACKET: 2407 case CDROM_SEND_PACKET:
2408 case SCSI_IOCTL_SEND_COMMAND: 2408 case SCSI_IOCTL_SEND_COMMAND:
2409 return ioctl_by_bdev(pd->bdev, cmd, arg); 2409 return blkdev_ioctl(pd->bdev->bd_inode, file, cmd, arg);
2410 2410
2411 case CDROMEJECT: 2411 case CDROMEJECT:
2412 /* 2412 /*
@@ -2414,7 +2414,7 @@ static int pkt_ioctl(struct inode *inode, struct file *file, unsigned int cmd, u
2414 * have to unlock it or else the eject command fails. 2414 * have to unlock it or else the eject command fails.
2415 */ 2415 */
2416 pkt_lock_door(pd, 0); 2416 pkt_lock_door(pd, 0);
2417 return ioctl_by_bdev(pd->bdev, cmd, arg); 2417 return blkdev_ioctl(pd->bdev->bd_inode, file, cmd, arg);
2418 2418
2419 default: 2419 default:
2420 printk("pktcdvd: Unknown ioctl for %s (%x)\n", pd->name, cmd); 2420 printk("pktcdvd: Unknown ioctl for %s (%x)\n", pd->name, cmd);