diff options
| -rw-r--r-- | drivers/mtd/ubi/cdev.c | 33 |
1 files changed, 5 insertions, 28 deletions
diff --git a/drivers/mtd/ubi/cdev.c b/drivers/mtd/ubi/cdev.c index 5fc9fd457e69..fb238d7ade35 100644 --- a/drivers/mtd/ubi/cdev.c +++ b/drivers/mtd/ubi/cdev.c | |||
| @@ -414,19 +414,7 @@ static int vol_cdev_ioctl(struct inode *inode, struct file *file, | |||
| 414 | struct ubi_device *ubi = vol->ubi; | 414 | struct ubi_device *ubi = vol->ubi; |
| 415 | void __user *argp = (void __user *)arg; | 415 | void __user *argp = (void __user *)arg; |
| 416 | 416 | ||
| 417 | if (_IOC_NR(cmd) > VOL_CDEV_IOC_MAX_SEQ || | ||
| 418 | _IOC_TYPE(cmd) != UBI_VOL_IOC_MAGIC) | ||
| 419 | return -ENOTTY; | ||
| 420 | |||
| 421 | if (_IOC_DIR(cmd) && _IOC_READ) | ||
| 422 | err = !access_ok(VERIFY_WRITE, argp, _IOC_SIZE(cmd)); | ||
| 423 | else if (_IOC_DIR(cmd) && _IOC_WRITE) | ||
| 424 | err = !access_ok(VERIFY_READ, argp, _IOC_SIZE(cmd)); | ||
| 425 | if (err) | ||
| 426 | return -EFAULT; | ||
| 427 | |||
| 428 | switch (cmd) { | 417 | switch (cmd) { |
| 429 | |||
| 430 | /* Volume update command */ | 418 | /* Volume update command */ |
| 431 | case UBI_IOCVOLUP: | 419 | case UBI_IOCVOLUP: |
| 432 | { | 420 | { |
| @@ -472,7 +460,7 @@ static int vol_cdev_ioctl(struct inode *inode, struct file *file, | |||
| 472 | { | 460 | { |
| 473 | int32_t lnum; | 461 | int32_t lnum; |
| 474 | 462 | ||
| 475 | err = __get_user(lnum, (__user int32_t *)argp); | 463 | err = get_user(lnum, (__user int32_t *)argp); |
| 476 | if (err) { | 464 | if (err) { |
| 477 | err = -EFAULT; | 465 | err = -EFAULT; |
| 478 | break; | 466 | break; |
| @@ -588,17 +576,6 @@ static int ubi_cdev_ioctl(struct inode *inode, struct file *file, | |||
| 588 | struct ubi_volume_desc *desc; | 576 | struct ubi_volume_desc *desc; |
| 589 | void __user *argp = (void __user *)arg; | 577 | void __user *argp = (void __user *)arg; |
| 590 | 578 | ||
| 591 | if (_IOC_NR(cmd) > UBI_CDEV_IOC_MAX_SEQ || | ||
| 592 | _IOC_TYPE(cmd) != UBI_IOC_MAGIC) | ||
| 593 | return -ENOTTY; | ||
| 594 | |||
| 595 | if (_IOC_DIR(cmd) && _IOC_READ) | ||
| 596 | err = !access_ok(VERIFY_WRITE, argp, _IOC_SIZE(cmd)); | ||
| 597 | else if (_IOC_DIR(cmd) && _IOC_WRITE) | ||
| 598 | err = !access_ok(VERIFY_READ, argp, _IOC_SIZE(cmd)); | ||
| 599 | if (err) | ||
| 600 | return -EFAULT; | ||
| 601 | |||
| 602 | if (!capable(CAP_SYS_RESOURCE)) | 579 | if (!capable(CAP_SYS_RESOURCE)) |
| 603 | return -EPERM; | 580 | return -EPERM; |
| 604 | 581 | ||
| @@ -613,7 +590,7 @@ static int ubi_cdev_ioctl(struct inode *inode, struct file *file, | |||
| 613 | struct ubi_mkvol_req req; | 590 | struct ubi_mkvol_req req; |
| 614 | 591 | ||
| 615 | dbg_msg("create volume"); | 592 | dbg_msg("create volume"); |
| 616 | err = __copy_from_user(&req, argp, | 593 | err = copy_from_user(&req, argp, |
| 617 | sizeof(struct ubi_mkvol_req)); | 594 | sizeof(struct ubi_mkvol_req)); |
| 618 | if (err) { | 595 | if (err) { |
| 619 | err = -EFAULT; | 596 | err = -EFAULT; |
| @@ -630,7 +607,7 @@ static int ubi_cdev_ioctl(struct inode *inode, struct file *file, | |||
| 630 | if (err) | 607 | if (err) |
| 631 | break; | 608 | break; |
| 632 | 609 | ||
| 633 | err = __put_user(req.vol_id, (__user int32_t *)argp); | 610 | err = put_user(req.vol_id, (__user int32_t *)argp); |
| 634 | if (err) | 611 | if (err) |
| 635 | err = -EFAULT; | 612 | err = -EFAULT; |
| 636 | 613 | ||
| @@ -643,7 +620,7 @@ static int ubi_cdev_ioctl(struct inode *inode, struct file *file, | |||
| 643 | int vol_id; | 620 | int vol_id; |
| 644 | 621 | ||
| 645 | dbg_msg("remove volume"); | 622 | dbg_msg("remove volume"); |
| 646 | err = __get_user(vol_id, (__user int32_t *)argp); | 623 | err = get_user(vol_id, (__user int32_t *)argp); |
| 647 | if (err) { | 624 | if (err) { |
| 648 | err = -EFAULT; | 625 | err = -EFAULT; |
| 649 | break; | 626 | break; |
| @@ -670,7 +647,7 @@ static int ubi_cdev_ioctl(struct inode *inode, struct file *file, | |||
| 670 | struct ubi_rsvol_req req; | 647 | struct ubi_rsvol_req req; |
| 671 | 648 | ||
| 672 | dbg_msg("re-size volume"); | 649 | dbg_msg("re-size volume"); |
| 673 | err = __copy_from_user(&req, argp, | 650 | err = copy_from_user(&req, argp, |
| 674 | sizeof(struct ubi_rsvol_req)); | 651 | sizeof(struct ubi_rsvol_req)); |
| 675 | if (err) { | 652 | if (err) { |
| 676 | err = -EFAULT; | 653 | err = -EFAULT; |
