| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <20200529003512.4110852-4-viro@ZenIV.linux.org.uk>
Date: Fri, 29 May 2020 01:35:07 +0100
From: Al Viro <viro@...IV.linux.org.uk>
To: Linus Torvalds <torvalds@...ux-foundation.org>
Cc: linux-kernel@...r.kernel.org, linux-fsdevel@...r.kernel.org,
Ian Abbott <abbotti@....co.uk>
Subject: [PATCH 04/10] comedi: get rid of compat_alloc_user_space() mess in COMEDI_RANGEINFO compat
From: Al Viro <viro@...iv.linux.org.uk>
Just take copy_from_user() out of do_rangeing_ioctl() into the caller and
have compat_rangeinfo() build a native version and pass it to do_rangeinfo_ioctl()
directly.
Signed-off-by: Al Viro <viro@...iv.linux.org.uk>
---
drivers/staging/comedi/comedi_fops.c | 43 ++++++++++++++------------------
drivers/staging/comedi/comedi_internal.h | 2 +-
drivers/staging/comedi/range.c | 17 ++++++-------
3 files changed, 27 insertions(+), 35 deletions(-)
diff --git a/drivers/staging/comedi/comedi_fops.c b/drivers/staging/comedi/comedi_fops.c
index ab811735cd1b..d96dc85d8a98 100644
--- a/drivers/staging/comedi/comedi_fops.c
+++ b/drivers/staging/comedi/comedi_fops.c
@@ -2210,9 +2210,14 @@ static long comedi_unlocked_ioctl(struct file *file, unsigned int cmd,
rc = do_chaninfo_ioctl(dev, &it);
break;
}
- case COMEDI_RANGEINFO:
- rc = do_rangeinfo_ioctl(dev, (void __user *)arg);
+ case COMEDI_RANGEINFO: {
+ struct comedi_rangeinfo it;
+ if (copy_from_user(&it, (void __user *)arg, sizeof(it)))
+ rc = -EFAULT;
+ else
+ rc = do_rangeinfo_ioctl(dev, &it);
break;
+ }
case COMEDI_BUFINFO:
rc = do_bufinfo_ioctl(dev,
(struct comedi_bufinfo __user *)arg,
@@ -2900,32 +2905,22 @@ static int compat_chaninfo(struct file *file, unsigned long arg)
/* Handle 32-bit COMEDI_RANGEINFO ioctl. */
static int compat_rangeinfo(struct file *file, unsigned long arg)
{
- struct comedi_rangeinfo __user *rangeinfo;
- struct comedi32_rangeinfo_struct __user *rangeinfo32;
+ struct comedi_file *cfp = file->private_data;
+ struct comedi_device *dev = cfp->dev;
+ struct comedi32_rangeinfo_struct rangeinfo32;
+ struct comedi_rangeinfo rangeinfo;
int err;
- union {
- unsigned int uint;
- compat_uptr_t uptr;
- } temp;
-
- rangeinfo32 = compat_ptr(arg);
- rangeinfo = compat_alloc_user_space(sizeof(*rangeinfo));
- /* Copy rangeinfo structure. */
- if (!access_ok(rangeinfo32, sizeof(*rangeinfo32)) ||
- !access_ok(rangeinfo, sizeof(*rangeinfo)))
+ if (copy_from_user(&rangeinfo32, compat_ptr(arg), sizeof(rangeinfo32)))
return -EFAULT;
+ memset(&rangeinfo, 0, sizeof(rangeinfo));
+ rangeinfo.range_type = rangeinfo32.range_type;
+ rangeinfo.range_ptr = compat_ptr(rangeinfo32.range_ptr);
- err = 0;
- err |= __get_user(temp.uint, &rangeinfo32->range_type);
- err |= __put_user(temp.uint, &rangeinfo->range_type);
- err |= __get_user(temp.uptr, &rangeinfo32->range_ptr);
- err |= __put_user(compat_ptr(temp.uptr), &rangeinfo->range_ptr);
- if (err)
- return -EFAULT;
-
- return comedi_unlocked_ioctl(file, COMEDI_RANGEINFO,
- (unsigned long)rangeinfo);
+ mutex_lock(&dev->mutex);
+ err = do_rangeinfo_ioctl(dev, &rangeinfo);
+ mutex_unlock(&dev->mutex);
+ return err;
}
/* Copy 32-bit cmd structure to native cmd structure. */
diff --git a/drivers/staging/comedi/comedi_internal.h b/drivers/staging/comedi/comedi_internal.h
index 515f293a5d26..7c8f18f55122 100644
--- a/drivers/staging/comedi/comedi_internal.h
+++ b/drivers/staging/comedi/comedi_internal.h
@@ -18,7 +18,7 @@ struct comedi_subdevice;
struct device;
int do_rangeinfo_ioctl(struct comedi_device *dev,
- struct comedi_rangeinfo __user *arg);
+ struct comedi_rangeinfo *it);
struct comedi_device *comedi_alloc_board_minor(struct device *hardware_device);
void comedi_release_hardware_device(struct device *hardware_device);
int comedi_alloc_subdevice_minor(struct comedi_subdevice *s);
diff --git a/drivers/staging/comedi/range.c b/drivers/staging/comedi/range.c
index 89d599877445..a4e6fe0fb729 100644
--- a/drivers/staging/comedi/range.c
+++ b/drivers/staging/comedi/range.c
@@ -46,17 +46,14 @@ EXPORT_SYMBOL_GPL(range_unknown);
* array of comedi_krange structures to rangeinfo->range_ptr pointer
*/
int do_rangeinfo_ioctl(struct comedi_device *dev,
- struct comedi_rangeinfo __user *arg)
+ struct comedi_rangeinfo *it)
{
- struct comedi_rangeinfo it;
int subd, chan;
const struct comedi_lrange *lr;
struct comedi_subdevice *s;
- if (copy_from_user(&it, arg, sizeof(struct comedi_rangeinfo)))
- return -EFAULT;
- subd = (it.range_type >> 24) & 0xf;
- chan = (it.range_type >> 16) & 0xff;
+ subd = (it->range_type >> 24) & 0xf;
+ chan = (it->range_type >> 16) & 0xff;
if (!dev->attached)
return -EINVAL;
@@ -73,15 +70,15 @@ int do_rangeinfo_ioctl(struct comedi_device *dev,
return -EINVAL;
}
- if (RANGE_LENGTH(it.range_type) != lr->length) {
+ if (RANGE_LENGTH(it->range_type) != lr->length) {
dev_dbg(dev->class_dev,
"wrong length %d should be %d (0x%08x)\n",
- RANGE_LENGTH(it.range_type),
- lr->length, it.range_type);
+ RANGE_LENGTH(it->range_type),
+ lr->length, it->range_type);
return -EINVAL;
}
- if (copy_to_user(it.range_ptr, lr->range,
+ if (copy_to_user(it->range_ptr, lr->range,
sizeof(struct comedi_krange) * lr->length))
return -EFAULT;
--
2.11.0
Powered by blists - more mailing lists