Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8d1a81a8 authored by Al Viro's avatar Al Viro
Browse files

sanitize do_i2c_smbus_ioctl()



no need to mess with __copy_in_user()

Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
parent 2ea659a9
Loading
Loading
Loading
Loading
+9 −10
Original line number Diff line number Diff line
@@ -739,23 +739,22 @@ static int do_i2c_smbus_ioctl(struct file *file,
		unsigned int cmd, struct i2c_smbus_ioctl_data32   __user *udata)
{
	struct i2c_smbus_ioctl_data	__user *tdata;
	compat_caddr_t			datap;
	union {
		/* beginnings of those have identical layouts */
		struct i2c_smbus_ioctl_data32	data32;
		struct i2c_smbus_ioctl_data	data;
	} v;

	tdata = compat_alloc_user_space(sizeof(*tdata));
	if (tdata == NULL)
		return -ENOMEM;
	if (!access_ok(VERIFY_WRITE, tdata, sizeof(*tdata)))
		return -EFAULT;

	if (!access_ok(VERIFY_READ, udata, sizeof(*udata)))
	memset(&v, 0, sizeof(v));
	if (copy_from_user(&v.data32, udata, sizeof(v.data32)))
		return -EFAULT;
	v.data.data = compat_ptr(v.data32.data);

	if (__copy_in_user(&tdata->read_write, &udata->read_write, 2 * sizeof(u8)))
		return -EFAULT;
	if (__copy_in_user(&tdata->size, &udata->size, 2 * sizeof(u32)))
		return -EFAULT;
	if (__get_user(datap, &udata->data) ||
	    __put_user(compat_ptr(datap), &tdata->data))
	if (copy_to_user(tdata, &v.data, sizeof(v.data)))
		return -EFAULT;

	return do_ioctl(file, cmd, (unsigned long)tdata);