Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge branch 'fixes'
* fixes:
v4l1: fix 32-bit compat microcode loading translation
De-pessimize rds_page_copy_user
+28
-31
+21
-11
drivers/media/video/v4l2-compat-ioctl32.c
+21
-11
drivers/media/video/v4l2-compat-ioctl32.c
···
193
193
struct video_code32 {
194
194
char loadwhat[16]; /* name or tag of file being passed */
195
195
compat_int_t datasize;
196
-
unsigned char *data;
196
+
compat_uptr_t data;
197
197
};
198
198
199
-
static int get_microcode32(struct video_code *kp, struct video_code32 __user *up)
199
+
static struct video_code __user *get_microcode32(struct video_code32 *kp)
200
200
{
201
-
if (!access_ok(VERIFY_READ, up, sizeof(struct video_code32)) ||
202
-
copy_from_user(kp->loadwhat, up->loadwhat, sizeof(up->loadwhat)) ||
203
-
get_user(kp->datasize, &up->datasize) ||
204
-
copy_from_user(kp->data, up->data, up->datasize))
205
-
return -EFAULT;
206
-
return 0;
201
+
struct video_code __user *up;
202
+
203
+
up = compat_alloc_user_space(sizeof(*up));
204
+
205
+
/*
206
+
* NOTE! We don't actually care if these fail. If the
207
+
* user address is invalid, the native ioctl will do
208
+
* the error handling for us
209
+
*/
210
+
(void) copy_to_user(up->loadwhat, kp->loadwhat, sizeof(up->loadwhat));
211
+
(void) put_user(kp->datasize, &up->datasize);
212
+
(void) put_user(compat_ptr(kp->data), &up->data);
213
+
return up;
207
214
}
208
215
209
216
#define VIDIOCGTUNER32 _IOWR('v', 4, struct video_tuner32)
···
746
739
struct video_tuner vt;
747
740
struct video_buffer vb;
748
741
struct video_window vw;
749
-
struct video_code vc;
742
+
struct video_code32 vc;
750
743
struct video_audio va;
751
744
#endif
752
745
struct v4l2_format v2f;
···
825
818
break;
826
819
827
820
case VIDIOCSMICROCODE:
828
-
err = get_microcode32(&karg.vc, up);
829
-
compatible_arg = 0;
821
+
/* Copy the 32-bit "video_code32" to kernel space */
822
+
if (copy_from_user(&karg.vc, up, sizeof(karg.vc)))
823
+
return -EFAULT;
824
+
/* Convert the 32-bit version to a 64-bit version in user space */
825
+
up = get_microcode32(&karg.vc);
830
826
break;
831
827
832
828
case VIDIOCSFREQ:
+7
-20
net/rds/page.c
+7
-20
net/rds/page.c
···
57
57
unsigned long ret;
58
58
void *addr;
59
59
60
-
if (to_user)
60
+
addr = kmap(page);
61
+
if (to_user) {
61
62
rds_stats_add(s_copy_to_user, bytes);
62
-
else
63
+
ret = copy_to_user(ptr, addr + offset, bytes);
64
+
} else {
63
65
rds_stats_add(s_copy_from_user, bytes);
64
-
65
-
addr = kmap_atomic(page, KM_USER0);
66
-
if (to_user)
67
-
ret = __copy_to_user_inatomic(ptr, addr + offset, bytes);
68
-
else
69
-
ret = __copy_from_user_inatomic(addr + offset, ptr, bytes);
70
-
kunmap_atomic(addr, KM_USER0);
71
-
72
-
if (ret) {
73
-
addr = kmap(page);
74
-
if (to_user)
75
-
ret = copy_to_user(ptr, addr + offset, bytes);
76
-
else
77
-
ret = copy_from_user(addr + offset, ptr, bytes);
78
-
kunmap(page);
79
-
if (ret)
80
-
return -EFAULT;
66
+
ret = copy_from_user(addr + offset, ptr, bytes);
81
67
}
68
+
kunmap(page);
82
69
83
-
return 0;
70
+
return ret ? -EFAULT : 0;
84
71
}
85
72
EXPORT_SYMBOL_GPL(rds_page_copy_user);
86
73