summaryrefslogtreecommitdiff
path: root/drivers/tty
diff options
context:
space:
mode:
authorJiri Slaby <jslaby@suse.cz>2020-08-18 11:57:00 +0300
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2020-08-18 14:45:21 +0300
commit36c39220129e4048b6810dc732b49b4f23f2dcee (patch)
tree4c74b5fbcb506ca4f3ab1e44554266751f025529 /drivers/tty
parentd7c91c50815beebe14905292404b048a26147c07 (diff)
downloadlinux-36c39220129e4048b6810dc732b49b4f23f2dcee.tar.xz
vc_screen: sanitize types in vcs_read
* pos is derived from the passed ppos, so make it long enough, i.e. loff_t * attr and uni_mode are booleans, so... * size is limited by vcs_size() which returns an int * read, p, orig_count and this_round are always ">= 0" and "< size", so uint is enough * row, col, and max_col are derived from vc->vc_cols (uint) and p, so make them uint too * tmp_count is derived from this_round, so make it an uint too. * use u16 * for org (instead of unsigned short *). No need to initialize org too. Signed-off-by: Jiri Slaby <jslaby@suse.cz> Link: https://lore.kernel.org/r/20200818085706.12163-10-jslaby@suse.cz Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/tty')
-rw-r--r--drivers/tty/vt/vc_screen.c15
1 files changed, 7 insertions, 8 deletions
diff --git a/drivers/tty/vt/vc_screen.c b/drivers/tty/vt/vc_screen.c
index 36b967825f68..c62c590ed816 100644
--- a/drivers/tty/vt/vc_screen.c
+++ b/drivers/tty/vt/vc_screen.c
@@ -256,12 +256,12 @@ vcs_read(struct file *file, char __user *buf, size_t count, loff_t *ppos)
struct inode *inode = file_inode(file);
struct vc_data *vc;
struct vcs_poll_data *poll;
- long pos, read;
- int attr, uni_mode, row, col, maxcol;
- unsigned short *org = NULL;
+ u16 *org;
+ unsigned int read, row, col, maxcol;
ssize_t ret;
char *con_buf;
- bool viewed;
+ loff_t pos;
+ bool viewed, attr, uni_mode;
con_buf = (char *) __get_free_page(GFP_KERNEL);
if (!con_buf)
@@ -295,9 +295,8 @@ vcs_read(struct file *file, char __user *buf, size_t count, loff_t *ppos)
ret = 0;
while (count) {
char *con_buf0, *con_buf_start;
- long this_round, size;
- ssize_t orig_count;
- long p = pos;
+ unsigned int this_round, orig_count, p = pos;
+ int size;
/* Check whether we are above size each round,
* as copy_to_user at the end of this loop
@@ -362,7 +361,7 @@ vcs_read(struct file *file, char __user *buf, size_t count, loff_t *ppos)
}
} else {
if (p < HEADER_SIZE) {
- size_t tmp_count;
+ unsigned int tmp_count;
/* clamp header values if they don't fit */
con_buf0[0] = min(vc->vc_rows, 0xFFu);