Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1f96beec authored by Jarkko Sakkinen's avatar Jarkko Sakkinen Committed by Daniel Vetter
Browse files

drm: remove redundant code form drm_ioc32.c 



The compat ioctl handler ends up calling access_ok() twice: first
indirectly inside compat_alloc_user_space() and then after returning
from that function. This patch fixes issue.

v2: there were three invalid removals of access_ok() that I've fixed.
Also went through all the changes couple of times and verified that
access_ok() is only removed when the buffer is allocated with
compat_alloc_user_space(). My deepest apologies for this kind of
sloppiness!

Signed-off-by: default avatarJarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
parent e4f31ad2

drivers/gpu/drm/drm_ioc32.c

+26 −29
Original line number Original line Diff line number Diff line
@@ -93,7 +93,7 @@ static int compat_drm_version(struct file *file, unsigned int cmd, 
		return -EFAULT;

		return -EFAULT;





	version = compat_alloc_user_space(sizeof(*version));

	version = compat_alloc_user_space(sizeof(*version));

	if (!access_ok(VERIFY_WRITE, version, sizeof(*version)))

	if (!version)

		return -EFAULT;

		return -EFAULT;

	if (__put_user(v32.name_len, &version->name_len)

	if (__put_user(v32.name_len, &version->name_len)

	    || __put_user((void __user *)(unsigned long)v32.name,

	    || __put_user((void __user *)(unsigned long)v32.name,
@@ -140,7 +140,7 @@ static int compat_drm_getunique(struct file *file, unsigned int cmd, 
		return -EFAULT;

		return -EFAULT;





	u = compat_alloc_user_space(sizeof(*u));

	u = compat_alloc_user_space(sizeof(*u));

	if (!access_ok(VERIFY_WRITE, u, sizeof(*u)))

	if (!u)

		return -EFAULT;

		return -EFAULT;

	if (__put_user(uq32.unique_len, &u->unique_len)

	if (__put_user(uq32.unique_len, &u->unique_len)

	    || __put_user((void __user *)(unsigned long)uq32.unique,

	    || __put_user((void __user *)(unsigned long)uq32.unique,
@@ -168,7 +168,7 @@ static int compat_drm_setunique(struct file *file, unsigned int cmd, 
		return -EFAULT;

		return -EFAULT;





	u = compat_alloc_user_space(sizeof(*u));

	u = compat_alloc_user_space(sizeof(*u));

	if (!access_ok(VERIFY_WRITE, u, sizeof(*u)))

	if (!u)

		return -EFAULT;

		return -EFAULT;

	if (__put_user(uq32.unique_len, &u->unique_len)

	if (__put_user(uq32.unique_len, &u->unique_len)

	    || __put_user((void __user *)(unsigned long)uq32.unique,

	    || __put_user((void __user *)(unsigned long)uq32.unique,
@@ -200,7 +200,7 @@ static int compat_drm_getmap(struct file *file, unsigned int cmd, 
		return -EFAULT;

		return -EFAULT;





	map = compat_alloc_user_space(sizeof(*map));

	map = compat_alloc_user_space(sizeof(*map));

	if (!access_ok(VERIFY_WRITE, map, sizeof(*map)))

	if (!map)

		return -EFAULT;

		return -EFAULT;

	if (__put_user(idx, &map->offset))

	if (__put_user(idx, &map->offset))

		return -EFAULT;

		return -EFAULT;
@@ -237,7 +237,7 @@ static int compat_drm_addmap(struct file *file, unsigned int cmd, 
		return -EFAULT;

		return -EFAULT;





	map = compat_alloc_user_space(sizeof(*map));

	map = compat_alloc_user_space(sizeof(*map));

	if (!access_ok(VERIFY_WRITE, map, sizeof(*map)))

	if (!map)

		return -EFAULT;

		return -EFAULT;

	if (__put_user(m32.offset, &map->offset)

	if (__put_user(m32.offset, &map->offset)

	    || __put_user(m32.size, &map->size)

	    || __put_user(m32.size, &map->size)
@@ -277,7 +277,7 @@ static int compat_drm_rmmap(struct file *file, unsigned int cmd, 
		return -EFAULT;

		return -EFAULT;





	map = compat_alloc_user_space(sizeof(*map));

	map = compat_alloc_user_space(sizeof(*map));

	if (!access_ok(VERIFY_WRITE, map, sizeof(*map)))

	if (!map)

		return -EFAULT;

		return -EFAULT;

	if (__put_user((void *)(unsigned long)handle, &map->handle))

	if (__put_user((void *)(unsigned long)handle, &map->handle))

		return -EFAULT;

		return -EFAULT;
@@ -306,7 +306,7 @@ static int compat_drm_getclient(struct file *file, unsigned int cmd, 
		return -EFAULT;

		return -EFAULT;





	client = compat_alloc_user_space(sizeof(*client));

	client = compat_alloc_user_space(sizeof(*client));

	if (!access_ok(VERIFY_WRITE, client, sizeof(*client)))

	if (!client)

		return -EFAULT;

		return -EFAULT;

	if (__put_user(idx, &client->idx))

	if (__put_user(idx, &client->idx))

		return -EFAULT;

		return -EFAULT;
@@ -345,7 +345,7 @@ static int compat_drm_getstats(struct file *file, unsigned int cmd, 
	int i, err;

	int i, err;





	stats = compat_alloc_user_space(sizeof(*stats));

	stats = compat_alloc_user_space(sizeof(*stats));

	if (!access_ok(VERIFY_WRITE, stats, sizeof(*stats)))

	if (!stats)

		return -EFAULT;

		return -EFAULT;





	err = drm_ioctl(file, DRM_IOCTL_GET_STATS, (unsigned long)stats);

	err = drm_ioctl(file, DRM_IOCTL_GET_STATS, (unsigned long)stats);
@@ -382,8 +382,7 @@ static int compat_drm_addbufs(struct file *file, unsigned int cmd, 
	unsigned long agp_start;

	unsigned long agp_start;





	buf = compat_alloc_user_space(sizeof(*buf));

	buf = compat_alloc_user_space(sizeof(*buf));

	if (!access_ok(VERIFY_WRITE, buf, sizeof(*buf))

	if (!buf || !access_ok(VERIFY_WRITE, argp, sizeof(*argp)))

	    || !access_ok(VERIFY_WRITE, argp, sizeof(*argp)))

		return -EFAULT;

		return -EFAULT;





	if (__copy_in_user(buf, argp, offsetof(drm_buf_desc32_t, agp_start))

	if (__copy_in_user(buf, argp, offsetof(drm_buf_desc32_t, agp_start))
@@ -414,7 +413,7 @@ static int compat_drm_markbufs(struct file *file, unsigned int cmd, 
		return -EFAULT;

		return -EFAULT;





	buf = compat_alloc_user_space(sizeof(*buf));

	buf = compat_alloc_user_space(sizeof(*buf));

	if (!access_ok(VERIFY_WRITE, buf, sizeof(*buf)))

	if (!buf)

		return -EFAULT;

		return -EFAULT;





	if (__put_user(b32.size, &buf->size)

	if (__put_user(b32.size, &buf->size)
@@ -455,7 +454,7 @@ static int compat_drm_infobufs(struct file *file, unsigned int cmd, 




	nbytes = sizeof(*request) + count * sizeof(struct drm_buf_desc);

	nbytes = sizeof(*request) + count * sizeof(struct drm_buf_desc);

	request = compat_alloc_user_space(nbytes);

	request = compat_alloc_user_space(nbytes);

	if (!access_ok(VERIFY_WRITE, request, nbytes))

	if (!request)

		return -EFAULT;

		return -EFAULT;

	list = (struct drm_buf_desc *) (request + 1);

	list = (struct drm_buf_desc *) (request + 1);
@@ -516,7 +515,7 @@ static int compat_drm_mapbufs(struct file *file, unsigned int cmd, 
		return -EINVAL;

		return -EINVAL;

	nbytes = sizeof(*request) + count * sizeof(struct drm_buf_pub);

	nbytes = sizeof(*request) + count * sizeof(struct drm_buf_pub);

	request = compat_alloc_user_space(nbytes);

	request = compat_alloc_user_space(nbytes);

	if (!access_ok(VERIFY_WRITE, request, nbytes))

	if (!request)

		return -EFAULT;

		return -EFAULT;

	list = (struct drm_buf_pub *) (request + 1);

	list = (struct drm_buf_pub *) (request + 1);
@@ -563,7 +562,7 @@ static int compat_drm_freebufs(struct file *file, unsigned int cmd, 
		return -EFAULT;

		return -EFAULT;





	request = compat_alloc_user_space(sizeof(*request));

	request = compat_alloc_user_space(sizeof(*request));

	if (!access_ok(VERIFY_WRITE, request, sizeof(*request)))

	if (!request)

		return -EFAULT;

		return -EFAULT;

	if (__put_user(req32.count, &request->count)

	if (__put_user(req32.count, &request->count)

	    || __put_user((int __user *)(unsigned long)req32.list,

	    || __put_user((int __user *)(unsigned long)req32.list,
@@ -589,7 +588,7 @@ static int compat_drm_setsareactx(struct file *file, unsigned int cmd, 
		return -EFAULT;

		return -EFAULT;





	request = compat_alloc_user_space(sizeof(*request));

	request = compat_alloc_user_space(sizeof(*request));

	if (!access_ok(VERIFY_WRITE, request, sizeof(*request)))

	if (!request)

		return -EFAULT;

		return -EFAULT;

	if (__put_user(req32.ctx_id, &request->ctx_id)

	if (__put_user(req32.ctx_id, &request->ctx_id)

	    || __put_user((void *)(unsigned long)req32.handle,

	    || __put_user((void *)(unsigned long)req32.handle,
@@ -613,7 +612,7 @@ static int compat_drm_getsareactx(struct file *file, unsigned int cmd, 
		return -EFAULT;

		return -EFAULT;





	request = compat_alloc_user_space(sizeof(*request));

	request = compat_alloc_user_space(sizeof(*request));

	if (!access_ok(VERIFY_WRITE, request, sizeof(*request)))

	if (!request)

		return -EFAULT;

		return -EFAULT;

	if (__put_user(ctx_id, &request->ctx_id))

	if (__put_user(ctx_id, &request->ctx_id))

		return -EFAULT;

		return -EFAULT;
@@ -646,7 +645,7 @@ static int compat_drm_resctx(struct file *file, unsigned int cmd, 
		return -EFAULT;

		return -EFAULT;





	res = compat_alloc_user_space(sizeof(*res));

	res = compat_alloc_user_space(sizeof(*res));

	if (!access_ok(VERIFY_WRITE, res, sizeof(*res)))

	if (!res)

		return -EFAULT;

		return -EFAULT;

	if (__put_user(res32.count, &res->count)

	if (__put_user(res32.count, &res->count)

	    || __put_user((struct drm_ctx __user *) (unsigned long)res32.contexts,

	    || __put_user((struct drm_ctx __user *) (unsigned long)res32.contexts,
@@ -689,7 +688,7 @@ static int compat_drm_dma(struct file *file, unsigned int cmd, 
		return -EFAULT;

		return -EFAULT;





	d = compat_alloc_user_space(sizeof(*d));

	d = compat_alloc_user_space(sizeof(*d));

	if (!access_ok(VERIFY_WRITE, d, sizeof(*d)))

	if (!d)

		return -EFAULT;

		return -EFAULT;





	if (__put_user(d32.context, &d->context)

	if (__put_user(d32.context, &d->context)
@@ -764,7 +763,7 @@ static int compat_drm_agp_info(struct file *file, unsigned int cmd, 
	int err;

	int err;





	info = compat_alloc_user_space(sizeof(*info));

	info = compat_alloc_user_space(sizeof(*info));

	if (!access_ok(VERIFY_WRITE, info, sizeof(*info)))

	if (!info)

		return -EFAULT;

		return -EFAULT;





	err = drm_ioctl(file, DRM_IOCTL_AGP_INFO, (unsigned long)info);

	err = drm_ioctl(file, DRM_IOCTL_AGP_INFO, (unsigned long)info);
@@ -807,7 +806,7 @@ static int compat_drm_agp_alloc(struct file *file, unsigned int cmd, 
		return -EFAULT;

		return -EFAULT;





	request = compat_alloc_user_space(sizeof(*request));

	request = compat_alloc_user_space(sizeof(*request));

	if (!access_ok(VERIFY_WRITE, request, sizeof(*request))

	if (!request

	    || __put_user(req32.size, &request->size)

	    || __put_user(req32.size, &request->size)

	    || __put_user(req32.type, &request->type))

	    || __put_user(req32.type, &request->type))

		return -EFAULT;

		return -EFAULT;
@@ -834,7 +833,7 @@ static int compat_drm_agp_free(struct file *file, unsigned int cmd, 
	u32 handle;

	u32 handle;





	request = compat_alloc_user_space(sizeof(*request));

	request = compat_alloc_user_space(sizeof(*request));

	if (!access_ok(VERIFY_WRITE, request, sizeof(*request))

	if (!request

	    || get_user(handle, &argp->handle)

	    || get_user(handle, &argp->handle)

	    || __put_user(handle, &request->handle))

	    || __put_user(handle, &request->handle))

		return -EFAULT;

		return -EFAULT;
@@ -858,7 +857,7 @@ static int compat_drm_agp_bind(struct file *file, unsigned int cmd, 
		return -EFAULT;

		return -EFAULT;





	request = compat_alloc_user_space(sizeof(*request));

	request = compat_alloc_user_space(sizeof(*request));

	if (!access_ok(VERIFY_WRITE, request, sizeof(*request))

	if (!request

	    || __put_user(req32.handle, &request->handle)

	    || __put_user(req32.handle, &request->handle)

	    || __put_user(req32.offset, &request->offset))

	    || __put_user(req32.offset, &request->offset))

		return -EFAULT;

		return -EFAULT;
@@ -874,7 +873,7 @@ static int compat_drm_agp_unbind(struct file *file, unsigned int cmd, 
	u32 handle;

	u32 handle;





	request = compat_alloc_user_space(sizeof(*request));

	request = compat_alloc_user_space(sizeof(*request));

	if (!access_ok(VERIFY_WRITE, request, sizeof(*request))

	if (!request

	    || get_user(handle, &argp->handle)

	    || get_user(handle, &argp->handle)

	    || __put_user(handle, &request->handle))

	    || __put_user(handle, &request->handle))

		return -EFAULT;

		return -EFAULT;
@@ -897,8 +896,7 @@ static int compat_drm_sg_alloc(struct file *file, unsigned int cmd, 
	unsigned long x;

	unsigned long x;





	request = compat_alloc_user_space(sizeof(*request));

	request = compat_alloc_user_space(sizeof(*request));

	if (!access_ok(VERIFY_WRITE, request, sizeof(*request))

	if (!request || !access_ok(VERIFY_WRITE, argp, sizeof(*argp))

	    || !access_ok(VERIFY_WRITE, argp, sizeof(*argp))

	    || __get_user(x, &argp->size)

	    || __get_user(x, &argp->size)

	    || __put_user(x, &request->size))

	    || __put_user(x, &request->size))

		return -EFAULT;

		return -EFAULT;
@@ -923,8 +921,7 @@ static int compat_drm_sg_free(struct file *file, unsigned int cmd, 
	unsigned long x;

	unsigned long x;





	request = compat_alloc_user_space(sizeof(*request));

	request = compat_alloc_user_space(sizeof(*request));

	if (!access_ok(VERIFY_WRITE, request, sizeof(*request))

	if (!request || !access_ok(VERIFY_WRITE, argp, sizeof(*argp))

	    || !access_ok(VERIFY_WRITE, argp, sizeof(*argp))

	    || __get_user(x, &argp->handle)

	    || __get_user(x, &argp->handle)

	    || __put_user(x << PAGE_SHIFT, &request->handle))

	    || __put_user(x << PAGE_SHIFT, &request->handle))

		return -EFAULT;

		return -EFAULT;
@@ -952,7 +949,7 @@ static int compat_drm_update_draw(struct file *file, unsigned int cmd, 
		return -EFAULT;

		return -EFAULT;





	request = compat_alloc_user_space(sizeof(*request));

	request = compat_alloc_user_space(sizeof(*request));

	if (!access_ok(VERIFY_WRITE, request, sizeof(*request)) ||

	if (!request ||

	    __put_user(update32.handle, &request->handle) ||

	    __put_user(update32.handle, &request->handle) ||

	    __put_user(update32.type, &request->type) ||

	    __put_user(update32.type, &request->type) ||

	    __put_user(update32.num, &request->num) ||

	    __put_user(update32.num, &request->num) ||
@@ -994,7 +991,7 @@ static int compat_drm_wait_vblank(struct file *file, unsigned int cmd, 
		return -EFAULT;

		return -EFAULT;





	request = compat_alloc_user_space(sizeof(*request));

	request = compat_alloc_user_space(sizeof(*request));

	if (!access_ok(VERIFY_WRITE, request, sizeof(*request))

	if (!request

	    || __put_user(req32.request.type, &request->request.type)

	    || __put_user(req32.request.type, &request->request.type)

	    || __put_user(req32.request.sequence, &request->request.sequence)

	    || __put_user(req32.request.sequence, &request->request.sequence)

	    || __put_user(req32.request.signal, &request->request.signal))

	    || __put_user(req32.request.signal, &request->request.signal))