diff options
| author | Al Viro <viro@zeniv.linux.org.uk> | 2017-05-02 19:46:27 +0300 |
|---|---|---|
| committer | Al Viro <viro@zeniv.linux.org.uk> | 2017-05-26 00:52:59 +0300 |
| commit | 8d1a81a852f58c5708cd607dcbe36eb32da5cbeb (patch) | |
| tree | 2b7ec762f45ae90bcb893e4ce4a317f0bd80ee67 /fs/compat_ioctl.c | |
| parent | 2ea659a9ef488125eb46da6eb571de5eae5c43f6 (diff) | |
| download | linux-8d1a81a852f58c5708cd607dcbe36eb32da5cbeb.tar.xz | |
sanitize do_i2c_smbus_ioctl()
no need to mess with __copy_in_user()
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Diffstat (limited to 'fs/compat_ioctl.c')
| -rw-r--r-- | fs/compat_ioctl.c | 19 |
1 files changed, 9 insertions, 10 deletions
diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c index 6116d5275a3e..2237e28fd5e1 100644 --- a/fs/compat_ioctl.c +++ b/fs/compat_ioctl.c @@ -739,23 +739,22 @@ static int do_i2c_smbus_ioctl(struct file *file, unsigned int cmd, struct i2c_smbus_ioctl_data32 __user *udata) { struct i2c_smbus_ioctl_data __user *tdata; - compat_caddr_t datap; + union { + /* beginnings of those have identical layouts */ + struct i2c_smbus_ioctl_data32 data32; + struct i2c_smbus_ioctl_data data; + } v; tdata = compat_alloc_user_space(sizeof(*tdata)); if (tdata == NULL) return -ENOMEM; - if (!access_ok(VERIFY_WRITE, tdata, sizeof(*tdata))) - return -EFAULT; - if (!access_ok(VERIFY_READ, udata, sizeof(*udata))) + memset(&v, 0, sizeof(v)); + if (copy_from_user(&v.data32, udata, sizeof(v.data32))) return -EFAULT; + v.data.data = compat_ptr(v.data32.data); - if (__copy_in_user(&tdata->read_write, &udata->read_write, 2 * sizeof(u8))) - return -EFAULT; - if (__copy_in_user(&tdata->size, &udata->size, 2 * sizeof(u32))) - return -EFAULT; - if (__get_user(datap, &udata->data) || - __put_user(compat_ptr(datap), &tdata->data)) + if (copy_to_user(tdata, &v.data, sizeof(v.data))) return -EFAULT; return do_ioctl(file, cmd, (unsigned long)tdata); |