Skip to content

Commit 4fdea58

Browse files
committed
Merge branch 'uaccess.__put_user' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
Pull uaccess/__put-user updates from Al Viro: "Removal of __put_user() calls - misc patches that don't fit into any other series" * 'uaccess.__put_user' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: pcm_native: result of put_user() needs to be checked scsi_ioctl.c: switch SCSI_IOCTL_GET_IDLUN to copy_to_user() compat sysinfo(2): don't bother with field-by-field copyout
2 parents e148a8f + ebe6976 commit 4fdea58

File tree

3 files changed

+35
-30
lines changed

3 files changed

+35
-30
lines changed

drivers/scsi/scsi_ioctl.c

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -211,18 +211,18 @@ static int scsi_ioctl_common(struct scsi_device *sdev, int cmd, void __user *arg
211211
}
212212

213213
switch (cmd) {
214-
case SCSI_IOCTL_GET_IDLUN:
215-
if (!access_ok(arg, sizeof(struct scsi_idlun)))
214+
case SCSI_IOCTL_GET_IDLUN: {
215+
struct scsi_idlun v = {
216+
.dev_id = (sdev->id & 0xff)
217+
+ ((sdev->lun & 0xff) << 8)
218+
+ ((sdev->channel & 0xff) << 16)
219+
+ ((sdev->host->host_no & 0xff) << 24),
220+
.host_unique_id = sdev->host->unique_id
221+
};
222+
if (copy_to_user(arg, &v, sizeof(struct scsi_idlun)))
216223
return -EFAULT;
217-
218-
__put_user((sdev->id & 0xff)
219-
+ ((sdev->lun & 0xff) << 8)
220-
+ ((sdev->channel & 0xff) << 16)
221-
+ ((sdev->host->host_no & 0xff) << 24),
222-
&((struct scsi_idlun __user *)arg)->dev_id);
223-
__put_user(sdev->host->unique_id,
224-
&((struct scsi_idlun __user *)arg)->host_unique_id);
225224
return 0;
225+
}
226226
case SCSI_IOCTL_GET_BUS_NUMBER:
227227
return put_user(sdev->host->host_no, (int __user *)arg);
228228
case SCSI_IOCTL_PROBE_HOST:

kernel/sys.c

Lines changed: 17 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -2634,6 +2634,7 @@ struct compat_sysinfo {
26342634
COMPAT_SYSCALL_DEFINE1(sysinfo, struct compat_sysinfo __user *, info)
26352635
{
26362636
struct sysinfo s;
2637+
struct compat_sysinfo s_32;
26372638

26382639
do_sysinfo(&s);
26392640

@@ -2658,23 +2659,23 @@ COMPAT_SYSCALL_DEFINE1(sysinfo, struct compat_sysinfo __user *, info)
26582659
s.freehigh >>= bitcount;
26592660
}
26602661

2661-
if (!access_ok(info, sizeof(struct compat_sysinfo)) ||
2662-
__put_user(s.uptime, &info->uptime) ||
2663-
__put_user(s.loads[0], &info->loads[0]) ||
2664-
__put_user(s.loads[1], &info->loads[1]) ||
2665-
__put_user(s.loads[2], &info->loads[2]) ||
2666-
__put_user(s.totalram, &info->totalram) ||
2667-
__put_user(s.freeram, &info->freeram) ||
2668-
__put_user(s.sharedram, &info->sharedram) ||
2669-
__put_user(s.bufferram, &info->bufferram) ||
2670-
__put_user(s.totalswap, &info->totalswap) ||
2671-
__put_user(s.freeswap, &info->freeswap) ||
2672-
__put_user(s.procs, &info->procs) ||
2673-
__put_user(s.totalhigh, &info->totalhigh) ||
2674-
__put_user(s.freehigh, &info->freehigh) ||
2675-
__put_user(s.mem_unit, &info->mem_unit))
2662+
memset(&s_32, 0, sizeof(s_32));
2663+
s_32.uptime = s.uptime;
2664+
s_32.loads[0] = s.loads[0];
2665+
s_32.loads[1] = s.loads[1];
2666+
s_32.loads[2] = s.loads[2];
2667+
s_32.totalram = s.totalram;
2668+
s_32.freeram = s.freeram;
2669+
s_32.sharedram = s.sharedram;
2670+
s_32.bufferram = s.bufferram;
2671+
s_32.totalswap = s.totalswap;
2672+
s_32.freeswap = s.freeswap;
2673+
s_32.procs = s.procs;
2674+
s_32.totalhigh = s.totalhigh;
2675+
s_32.freehigh = s.freehigh;
2676+
s_32.mem_unit = s.mem_unit;
2677+
if (copy_to_user(info, &s_32, sizeof(s_32)))
26762678
return -EFAULT;
2677-
26782679
return 0;
26792680
}
26802681
#endif /* CONFIG_COMPAT */

sound/core/pcm_native.c

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3093,7 +3093,8 @@ static int snd_pcm_xferi_frames_ioctl(struct snd_pcm_substream *substream,
30933093
result = snd_pcm_lib_write(substream, xferi.buf, xferi.frames);
30943094
else
30953095
result = snd_pcm_lib_read(substream, xferi.buf, xferi.frames);
3096-
__put_user(result, &_xferi->result);
3096+
if (put_user(result, &_xferi->result))
3097+
return -EFAULT;
30973098
return result < 0 ? result : 0;
30983099
}
30993100

@@ -3122,7 +3123,8 @@ static int snd_pcm_xfern_frames_ioctl(struct snd_pcm_substream *substream,
31223123
else
31233124
result = snd_pcm_lib_readv(substream, bufs, xfern.frames);
31243125
kfree(bufs);
3125-
__put_user(result, &_xfern->result);
3126+
if (put_user(result, &_xfern->result))
3127+
return -EFAULT;
31263128
return result < 0 ? result : 0;
31273129
}
31283130

@@ -3137,7 +3139,8 @@ static int snd_pcm_rewind_ioctl(struct snd_pcm_substream *substream,
31373139
if (put_user(0, _frames))
31383140
return -EFAULT;
31393141
result = snd_pcm_rewind(substream, frames);
3140-
__put_user(result, _frames);
3142+
if (put_user(result, _frames))
3143+
return -EFAULT;
31413144
return result < 0 ? result : 0;
31423145
}
31433146

@@ -3152,7 +3155,8 @@ static int snd_pcm_forward_ioctl(struct snd_pcm_substream *substream,
31523155
if (put_user(0, _frames))
31533156
return -EFAULT;
31543157
result = snd_pcm_forward(substream, frames);
3155-
__put_user(result, _frames);
3158+
if (put_user(result, _frames))
3159+
return -EFAULT;
31563160
return result < 0 ? result : 0;
31573161
}
31583162

0 commit comments

Comments
 (0)