Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 822bfa51 authored by Dan Carpenter's avatar Dan Carpenter Committed by Jens Axboe
Browse files

cdrom: use copy_to_user() without the underscores 



"nframes" comes from the user and "nframes * CD_FRAMESIZE_RAW" can wrap
on 32 bit systems.  That would have been ok if we used the same wrapped
value for the copy, but we use a shifted value.  We should just use the
checked version of copy_to_user() because it's not going to make a
difference to the speed.

Cc: stable@vger.kernel.com
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent 9fa73472

drivers/cdrom/cdrom.c

+1 −7
Original line number Original line Diff line number Diff line
@@ -2119,11 +2119,6 @@ static int cdrom_read_cdda_old(struct cdrom_device_info *cdi, __u8 __user *ubuf, 
	if (!nr)

	if (!nr)

		return -ENOMEM;

		return -ENOMEM;





	if (!access_ok(VERIFY_WRITE, ubuf, nframes * CD_FRAMESIZE_RAW)) {

		ret = -EFAULT;

		goto out;

	}



	cgc.data_direction = CGC_DATA_READ;

	cgc.data_direction = CGC_DATA_READ;

	while (nframes > 0) {

	while (nframes > 0) {

		if (nr > nframes)

		if (nr > nframes)
@@ -2132,7 +2127,7 @@ static int cdrom_read_cdda_old(struct cdrom_device_info *cdi, __u8 __user *ubuf, 
		ret = cdrom_read_block(cdi, &cgc, lba, nr, 1, CD_FRAMESIZE_RAW);

		ret = cdrom_read_block(cdi, &cgc, lba, nr, 1, CD_FRAMESIZE_RAW);

		if (ret)

		if (ret)

			break;

			break;

		if (__copy_to_user(ubuf, cgc.buffer, CD_FRAMESIZE_RAW * nr)) {

		if (copy_to_user(ubuf, cgc.buffer, CD_FRAMESIZE_RAW * nr)) {

			ret = -EFAULT;

			ret = -EFAULT;

			break;

			break;

		}

		}
@@ -2140,7 +2135,6 @@ static int cdrom_read_cdda_old(struct cdrom_device_info *cdi, __u8 __user *ubuf, 
		nframes -= nr;

		nframes -= nr;

		lba += nr;

		lba += nr;

	}

	}

out:

	kfree(cgc.buffer);

	kfree(cgc.buffer);

	return ret;

	return ret;

}

}