diff options
Diffstat (limited to 'drivers/tty/vt/vt_ioctl.c')
| -rw-r--r-- | drivers/tty/vt/vt_ioctl.c | 35 |
1 files changed, 13 insertions, 22 deletions
diff --git a/drivers/tty/vt/vt_ioctl.c b/drivers/tty/vt/vt_ioctl.c index a78ad10a119b..8b0ed139592f 100644 --- a/drivers/tty/vt/vt_ioctl.c +++ b/drivers/tty/vt/vt_ioctl.c @@ -32,6 +32,8 @@ #include <asm/io.h> #include <linux/uaccess.h> +#include <linux/nospec.h> + #include <linux/kbd_kern.h> #include <linux/vt_kern.h> #include <linux/kbd_diacr.h> @@ -700,6 +702,8 @@ int vt_ioctl(struct tty_struct *tty, if (vsa.console == 0 || vsa.console > MAX_NR_CONSOLES) ret = -ENXIO; else { + vsa.console = array_index_nospec(vsa.console, + MAX_NR_CONSOLES + 1); vsa.console--; console_lock(); ret = vc_allocate(vsa.console); @@ -1171,17 +1175,13 @@ long vt_compat_ioctl(struct tty_struct *tty, { struct vc_data *vc = tty->driver_data; struct console_font_op op; /* used in multiple places here */ - unsigned int console; - void __user *up = (void __user *)arg; + unsigned int console = vc->vc_num; + void __user *up = compat_ptr(arg); int perm; - int ret = 0; - console = vc->vc_num; - if (!vc_cons_allocated(console)) { /* impossible? */ - ret = -ENOIOCTLCMD; - goto out; - } + if (!vc_cons_allocated(console)) /* impossible? */ + return -ENOIOCTLCMD; /* * To have permissions to do most of the vt ioctls, we either have @@ -1197,17 +1197,14 @@ long vt_compat_ioctl(struct tty_struct *tty, */ case PIO_FONTX: case GIO_FONTX: - ret = compat_fontx_ioctl(cmd, up, perm, &op); - break; + return compat_fontx_ioctl(cmd, up, perm, &op); case KDFONTOP: - ret = compat_kdfontop_ioctl(up, perm, &op, vc); - break; + return compat_kdfontop_ioctl(up, perm, &op, vc); case PIO_UNIMAP: case GIO_UNIMAP: - ret = compat_unimap_ioctl(cmd, up, perm, vc); - break; + return compat_unimap_ioctl(cmd, up, perm, vc); /* * all these treat 'arg' as an integer @@ -1232,21 +1229,15 @@ long vt_compat_ioctl(struct tty_struct *tty, case VT_DISALLOCATE: case VT_RESIZE: case VT_RESIZEX: - goto fallback; + return vt_ioctl(tty, cmd, arg); /* * the rest has a compatible data structure behind arg, * but we have to convert it to a proper 64 bit pointer. */ default: - arg = (unsigned long)compat_ptr(arg); - goto fallback; + return vt_ioctl(tty, cmd, (unsigned long)up); } -out: - return ret; - -fallback: - return vt_ioctl(tty, cmd, arg); } |