Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 99d7d64b authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'fbdev-v4.16-rc5' of git://github.com/bzolnier/linux 

Pull fbdev fix from Bartlomiej Zolnierkiewicz:
 "Just a single fix to close a kernel data leak in FBIOGETCMAP_SPARC
  ioctl"

* tag 'fbdev-v4.16-rc5' of git://github.com/bzolnier/linux:
  fbdev: Fixing arbitrary kernel leak in case FBIOGETCMAP_SPARC in sbusfb_ioctl_helper().
parents 65307f2e 250c6c49

drivers/video/fbdev/sbuslib.c

+2 −2
Original line number Original line Diff line number Diff line
@@ -122,7 +122,7 @@ int sbusfb_ioctl_helper(unsigned long cmd, unsigned long arg, 
		unsigned char __user *ured;

		unsigned char __user *ured;

		unsigned char __user *ugreen;

		unsigned char __user *ugreen;

		unsigned char __user *ublue;

		unsigned char __user *ublue;

		int index, count, i;

		unsigned int index, count, i;





		if (get_user(index, &c->index) ||

		if (get_user(index, &c->index) ||

		    __get_user(count, &c->count) ||

		    __get_user(count, &c->count) ||
@@ -161,7 +161,7 @@ int sbusfb_ioctl_helper(unsigned long cmd, unsigned long arg, 
		unsigned char __user *ugreen;

		unsigned char __user *ugreen;

		unsigned char __user *ublue;

		unsigned char __user *ublue;

		struct fb_cmap *cmap = &info->cmap;

		struct fb_cmap *cmap = &info->cmap;

		int index, count, i;

		unsigned int index, count, i;

		u8 red, green, blue;

		u8 red, green, blue;





		if (get_user(index, &c->index) ||

		if (get_user(index, &c->index) ||