diff options
Diffstat (limited to 'drivers/tty/vt')
-rw-r--r-- | drivers/tty/vt/consolemap.c | 56 | ||||
-rw-r--r-- | drivers/tty/vt/keyboard.c | 3 | ||||
-rw-r--r-- | drivers/tty/vt/vt.c | 8 | ||||
-rw-r--r-- | drivers/tty/vt/vt_ioctl.c | 8 |
4 files changed, 21 insertions, 54 deletions
diff --git a/drivers/tty/vt/consolemap.c b/drivers/tty/vt/consolemap.c index 1f6e17fc3fb0..a5f88cf0f61d 100644 --- a/drivers/tty/vt/consolemap.c +++ b/drivers/tty/vt/consolemap.c @@ -322,15 +322,13 @@ int con_set_trans_old(unsigned char __user * arg) { int i; unsigned short inbuf[E_TABSZ]; + unsigned char ubuf[E_TABSZ]; - if (!access_ok(VERIFY_READ, arg, E_TABSZ)) + if (copy_from_user(ubuf, arg, E_TABSZ)) return -EFAULT; - for (i = 0; i < E_TABSZ ; i++) { - unsigned char uc; - __get_user(uc, arg+i); - inbuf[i] = UNI_DIRECT_BASE | uc; - } + for (i = 0; i < E_TABSZ ; i++) + inbuf[i] = UNI_DIRECT_BASE | ubuf[i]; console_lock(); memcpy(translations[USER_MAP], inbuf, sizeof(inbuf)); @@ -345,9 +343,6 @@ int con_get_trans_old(unsigned char __user * arg) unsigned short *p = translations[USER_MAP]; unsigned char outbuf[E_TABSZ]; - if (!access_ok(VERIFY_WRITE, arg, E_TABSZ)) - return -EFAULT; - console_lock(); for (i = 0; i < E_TABSZ ; i++) { @@ -356,22 +351,16 @@ int con_get_trans_old(unsigned char __user * arg) } console_unlock(); - for (i = 0; i < E_TABSZ ; i++) - __put_user(outbuf[i], arg+i); - return 0; + return copy_to_user(arg, outbuf, sizeof(outbuf)) ? -EFAULT : 0; } int con_set_trans_new(ushort __user * arg) { - int i; unsigned short inbuf[E_TABSZ]; - if (!access_ok(VERIFY_READ, arg, E_TABSZ*sizeof(unsigned short))) + if (copy_from_user(inbuf, arg, sizeof(inbuf))) return -EFAULT; - for (i = 0; i < E_TABSZ ; i++) - __get_user(inbuf[i], arg+i); - console_lock(); memcpy(translations[USER_MAP], inbuf, sizeof(inbuf)); update_user_maps(); @@ -381,19 +370,13 @@ int con_set_trans_new(ushort __user * arg) int con_get_trans_new(ushort __user * arg) { - int i; unsigned short outbuf[E_TABSZ]; - if (!access_ok(VERIFY_WRITE, arg, E_TABSZ*sizeof(unsigned short))) - return -EFAULT; - console_lock(); memcpy(outbuf, translations[USER_MAP], sizeof(outbuf)); console_unlock(); - for (i = 0; i < E_TABSZ ; i++) - __put_user(outbuf[i], arg+i); - return 0; + return copy_to_user(arg, outbuf, sizeof(outbuf)) ? -EFAULT : 0; } /* @@ -557,14 +540,9 @@ int con_set_unimap(struct vc_data *vc, ushort ct, struct unipair __user *list) if (!ct) return 0; - unilist = kmalloc_array(ct, sizeof(struct unipair), GFP_KERNEL); - if (!unilist) - return -ENOMEM; - - for (i = ct, plist = unilist; i; i--, plist++, list++) { - __get_user(plist->unicode, &list->unicode); - __get_user(plist->fontpos, &list->fontpos); - } + unilist = memdup_user(list, ct * sizeof(struct unipair)); + if (IS_ERR(unilist)) + return PTR_ERR(unilist); console_lock(); @@ -757,11 +735,11 @@ EXPORT_SYMBOL(con_copy_unimap); */ int con_get_unimap(struct vc_data *vc, ushort ct, ushort __user *uct, struct unipair __user *list) { - int i, j, k; + int i, j, k, ret = 0; ushort ect; u16 **p1, *p2; struct uni_pagedir *p; - struct unipair *unilist, *plist; + struct unipair *unilist; unilist = kmalloc_array(ct, sizeof(struct unipair), GFP_KERNEL); if (!unilist) @@ -792,13 +770,11 @@ int con_get_unimap(struct vc_data *vc, ushort ct, ushort __user *uct, struct uni } } console_unlock(); - for (i = min(ect, ct), plist = unilist; i; i--, list++, plist++) { - __put_user(plist->unicode, &list->unicode); - __put_user(plist->fontpos, &list->fontpos); - } - __put_user(ect, uct); + if (copy_to_user(list, unilist, min(ect, ct) * sizeof(struct unipair))) + ret = -EFAULT; + put_user(ect, uct); kfree(unilist); - return ((ect <= ct) ? 0 : -ENOMEM); + return ret ? ret : (ect <= ct) ? 0 : -ENOMEM; } /* diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c index 8af8d9542663..f4166263bb3a 100644 --- a/drivers/tty/vt/keyboard.c +++ b/drivers/tty/vt/keyboard.c @@ -1203,8 +1203,7 @@ DECLARE_TASKLET_DISABLED(keyboard_tasklet, kbd_bh, 0); #if defined(CONFIG_X86) || defined(CONFIG_IA64) || defined(CONFIG_ALPHA) ||\ defined(CONFIG_MIPS) || defined(CONFIG_PPC) || defined(CONFIG_SPARC) ||\ defined(CONFIG_PARISC) || defined(CONFIG_SUPERH) ||\ - (defined(CONFIG_ARM) && defined(CONFIG_KEYBOARD_ATKBD) && !defined(CONFIG_ARCH_RPC)) ||\ - defined(CONFIG_AVR32) + (defined(CONFIG_ARM) && defined(CONFIG_KEYBOARD_ATKBD) && !defined(CONFIG_ARCH_RPC)) #define HW_RAW(dev) (test_bit(EV_MSC, dev->evbit) && test_bit(MSC_RAW, dev->mscbit) &&\ ((dev)->id.bustype == BUS_I8042) && ((dev)->id.vendor == 0x0001) && ((dev)->id.product == 0x0001)) diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c index 9c9945284bcf..2ebaba16f785 100644 --- a/drivers/tty/vt/vt.c +++ b/drivers/tty/vt/vt.c @@ -425,7 +425,7 @@ static u8 build_attr(struct vc_data *vc, u8 _color, u8 _intensity, u8 _blink, else if (_underline) a = (a & 0xf0) | vc->vc_ulcolor; else if (_intensity == 0) - a = (a & 0xf0) | vc->vc_ulcolor; + a = (a & 0xf0) | vc->vc_halfcolor; if (_reverse) a = ((a) & 0x88) | ((((a) >> 4) | ((a) << 4)) & 0x77); if (_blink) @@ -2709,13 +2709,13 @@ int tioclinux(struct tty_struct *tty, unsigned long arg) * related to the kernel should not use this. */ data = vt_get_shift_state(); - ret = __put_user(data, p); + ret = put_user(data, p); break; case TIOCL_GETMOUSEREPORTING: console_lock(); /* May be overkill */ data = mouse_reporting(); console_unlock(); - ret = __put_user(data, p); + ret = put_user(data, p); break; case TIOCL_SETVESABLANK: console_lock(); @@ -2724,7 +2724,7 @@ int tioclinux(struct tty_struct *tty, unsigned long arg) break; case TIOCL_GETKMSGREDIRECT: data = vt_get_kmsg_redirect(); - ret = __put_user(data, p); + ret = put_user(data, p); break; case TIOCL_SETKMSGREDIRECT: if (!capable(CAP_SYS_ADMIN)) { diff --git a/drivers/tty/vt/vt_ioctl.c b/drivers/tty/vt/vt_ioctl.c index 0cbfe1ff6f6c..96d389cb506c 100644 --- a/drivers/tty/vt/vt_ioctl.c +++ b/drivers/tty/vt/vt_ioctl.c @@ -266,10 +266,6 @@ do_unimap_ioctl(int cmd, struct unimapdesc __user *user_ud, int perm, struct vc_ if (copy_from_user(&tmp, user_ud, sizeof tmp)) return -EFAULT; - if (tmp.entries) - if (!access_ok(VERIFY_WRITE, tmp.entries, - tmp.entry_ct*sizeof(struct unipair))) - return -EFAULT; switch (cmd) { case PIO_UNIMAP: if (!perm) @@ -1170,10 +1166,6 @@ compat_unimap_ioctl(unsigned int cmd, struct compat_unimapdesc __user *user_ud, if (copy_from_user(&tmp, user_ud, sizeof tmp)) return -EFAULT; tmp_entries = compat_ptr(tmp.entries); - if (tmp_entries) - if (!access_ok(VERIFY_WRITE, tmp_entries, - tmp.entry_ct*sizeof(struct unipair))) - return -EFAULT; switch (cmd) { case PIO_UNIMAP: if (!perm) |