diff options
| author |   Adam Borowski <kilobyte@angband.pl> | 2017-06-03 09:35:07 +0200 |
|---|---|---|
| committer |   Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2017-06-09 11:07:36 +0200 |
| commit | 915f0a8d2884d05538ae5c06e09f40d364fa2c3f (patch) | |
| tree | d30b6abab427a4fb5a63202c7c1613aaed409768 /drivers/tty/vt | |
| parent | vt: fix unchecked __put_user() in tioclinux ioctls (diff) | |
| download | linux-dev-915f0a8d2884d05538ae5c06e09f40d364fa2c3f.tar.xz linux-dev-915f0a8d2884d05538ae5c06e09f40d364fa2c3f.zip | |
vt: use copy_to_user instead of __put_user in GIO_UNIMAP ioctl
A nice big linear transfer, no need to flip stac/PAN/etc every half-entry.
Also, yay __put_user() after checking only read.
Signed-off-by: Adam Borowski <kilobyte@angband.pl>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/tty/vt')
| -rw-r--r-- | drivers/tty/vt/consolemap.c | 14 |
1 files changed, 6 insertions, 8 deletions
diff --git a/drivers/tty/vt/consolemap.c b/drivers/tty/vt/consolemap.c index 1361f2a8b832..c6a692f63a9b 100644 --- a/drivers/tty/vt/consolemap.c +++ b/drivers/tty/vt/consolemap.c @@ -740,11 +740,11 @@ EXPORT_SYMBOL(con_copy_unimap); */ int con_get_unimap(struct vc_data *vc, ushort ct, ushort __user *uct, struct unipair __user *list) { - int i, j, k; + int i, j, k, ret = 0; ushort ect; u16 **p1, *p2; struct uni_pagedir *p; - struct unipair *unilist, *plist; + struct unipair *unilist; unilist = kmalloc_array(ct, sizeof(struct unipair), GFP_KERNEL); if (!unilist) @@ -775,13 +775,11 @@ int con_get_unimap(struct vc_data *vc, ushort ct, ushort __user *uct, struct uni } } console_unlock(); - for (i = min(ect, ct), plist = unilist; i; i--, list++, plist++) { - __put_user(plist->unicode, &list->unicode); - __put_user(plist->fontpos, &list->fontpos); - } - __put_user(ect, uct); + if (copy_to_user(list, unilist, min(ect, ct) * sizeof(struct unipair))) + ret = -EFAULT; + put_user(ect, uct); kfree(unilist); - return ((ect <= ct) ? 0 : -ENOMEM); + return ret ? ret : (ect <= ct) ? 0 : -ENOMEM; } /* |