@@ -537,7 +537,7 @@ static int create_elf_fdpic_tables(struct linux_binprm *bprm,
537
537
platform_len = strlen (k_platform ) + 1 ;
538
538
sp -= platform_len ;
539
539
u_platform = (char __user * ) sp ;
540
- if (__copy_to_user (u_platform , k_platform , platform_len ) != 0 )
540
+ if (copy_to_user (u_platform , k_platform , platform_len ) != 0 )
541
541
return - EFAULT ;
542
542
}
543
543
@@ -552,7 +552,7 @@ static int create_elf_fdpic_tables(struct linux_binprm *bprm,
552
552
platform_len = strlen (k_base_platform ) + 1 ;
553
553
sp -= platform_len ;
554
554
u_base_platform = (char __user * ) sp ;
555
- if (__copy_to_user (u_base_platform , k_base_platform , platform_len ) != 0 )
555
+ if (copy_to_user (u_base_platform , k_base_platform , platform_len ) != 0 )
556
556
return - EFAULT ;
557
557
}
558
558
@@ -604,11 +604,13 @@ static int create_elf_fdpic_tables(struct linux_binprm *bprm,
604
604
/* put the ELF interpreter info on the stack */
605
605
#define NEW_AUX_ENT (id , val ) \
606
606
do { \
607
- struct { unsigned long _id, _val; } __user *ent; \
607
+ struct { unsigned long _id, _val; } __user *ent, v ; \
608
608
\
609
609
ent = (void __user *) csp; \
610
- __put_user((id), &ent[nr]._id); \
611
- __put_user((val), &ent[nr]._val); \
610
+ v._id = (id); \
611
+ v._val = (val); \
612
+ if (copy_to_user(ent + nr, &v, sizeof(v))) \
613
+ return -EFAULT; \
612
614
nr++; \
613
615
} while (0)
614
616
@@ -675,7 +677,8 @@ static int create_elf_fdpic_tables(struct linux_binprm *bprm,
675
677
676
678
/* stack argc */
677
679
csp -= sizeof (unsigned long );
678
- __put_user (bprm -> argc , (unsigned long __user * ) csp );
680
+ if (put_user (bprm -> argc , (unsigned long __user * ) csp ))
681
+ return - EFAULT ;
679
682
680
683
BUG_ON (csp != sp );
681
684
@@ -689,25 +692,29 @@ static int create_elf_fdpic_tables(struct linux_binprm *bprm,
689
692
690
693
p = (char __user * ) current -> mm -> arg_start ;
691
694
for (loop = bprm -> argc ; loop > 0 ; loop -- ) {
692
- __put_user ((elf_caddr_t ) p , argv ++ );
695
+ if (put_user ((elf_caddr_t ) p , argv ++ ))
696
+ return - EFAULT ;
693
697
len = strnlen_user (p , MAX_ARG_STRLEN );
694
698
if (!len || len > MAX_ARG_STRLEN )
695
699
return - EINVAL ;
696
700
p += len ;
697
701
}
698
- __put_user (NULL , argv );
702
+ if (put_user (NULL , argv ))
703
+ return - EFAULT ;
699
704
current -> mm -> arg_end = (unsigned long ) p ;
700
705
701
706
/* fill in the envv[] array */
702
707
current -> mm -> env_start = (unsigned long ) p ;
703
708
for (loop = bprm -> envc ; loop > 0 ; loop -- ) {
704
- __put_user ((elf_caddr_t )(unsigned long ) p , envp ++ );
709
+ if (put_user ((elf_caddr_t )(unsigned long ) p , envp ++ ))
710
+ return - EFAULT ;
705
711
len = strnlen_user (p , MAX_ARG_STRLEN );
706
712
if (!len || len > MAX_ARG_STRLEN )
707
713
return - EINVAL ;
708
714
p += len ;
709
715
}
710
- __put_user (NULL , envp );
716
+ if (put_user (NULL , envp ))
717
+ return - EFAULT ;
711
718
current -> mm -> env_end = (unsigned long ) p ;
712
719
713
720
mm -> start_stack = (unsigned long ) sp ;
@@ -849,8 +856,8 @@ static int elf_fdpic_map_file(struct elf_fdpic_params *params,
849
856
850
857
tmp = phdr -> p_memsz / sizeof (Elf32_Dyn );
851
858
dyn = (Elf32_Dyn __user * )params -> dynamic_addr ;
852
- __get_user ( d_tag , & dyn [tmp - 1 ].d_tag );
853
- if ( d_tag != 0 )
859
+ if ( get_user ( d_tag , & dyn [tmp - 1 ].d_tag ) ||
860
+ d_tag != 0 )
854
861
goto dynamic_error ;
855
862
break ;
856
863
}
0 commit comments