* Re: [PATCH] check copy_from_user return value in sony535
[not found] <E1A6XJm-0003Vi-00.adobriyan-mail-ru@f20.mail.ru>
@ 2003-10-06 16:05 ` Felipe W Damasio
2003-10-06 16:10 ` Jens Axboe
0 siblings, 1 reply; 4+ messages in thread
From: Felipe W Damasio @ 2003-10-06 16:05 UTC (permalink / raw)
To: Alexey Dobriyan; +Cc: Jens Axboe, Linux Kernel Mailing List
[-- Attachment #1: Type: text/plain, Size: 273 bytes --]
Hi Alexey,
Alexey Dobriyan wrote:
> Fell free to nuke verify_area() right before 'return err;' ;-)
Right :)
> Moving copy_from_user() before spin_up_drive() then also seems right thing to do.
Oh, ok.
Jens, please apply this patch instead.
Thanks Alexey,
Felipe
[-- Attachment #2: sonycd535-copy_from_user.patch --]
[-- Type: text/plain, Size: 637 bytes --]
--- linux-2.6.0-test6/drivers/cdrom/sonycd535.c.orig 2003-10-06 10:46:56.000000000 -0300
+++ linux-2.6.0-test6/drivers/cdrom/sonycd535.c 2003-10-06 13:03:13.000000000 -0300
@@ -1153,12 +1153,10 @@
break;
case CDROMPLAYMSF: /* Play starting at the given MSF address. */
- err = verify_area(VERIFY_READ, (char *)arg, 6);
- if (err)
- return err;
+ if (copy_from_user(params, (void *)arg, 6))
+ return -EFAULT;
spin_up_drive(status);
set_drive_mode(SONY535_AUDIO_DRIVE_MODE, status);
- copy_from_user(params, (void *)arg, 6);
/* The parameters are given in int, must be converted */
for (i = 0; i < 3; i++) {
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH] check copy_from_user return value in sony535
2003-10-06 16:05 ` [PATCH] check copy_from_user return value in sony535 Felipe W Damasio
@ 2003-10-06 16:10 ` Jens Axboe
0 siblings, 0 replies; 4+ messages in thread
From: Jens Axboe @ 2003-10-06 16:10 UTC (permalink / raw)
To: Felipe W Damasio; +Cc: Alexey Dobriyan, Linux Kernel Mailing List
On Mon, Oct 06 2003, Felipe W Damasio wrote:
> Hi Alexey,
>
> Alexey Dobriyan wrote:
> >Fell free to nuke verify_area() right before 'return err;' ;-)
>
> Right :)
>
> >Moving copy_from_user() before spin_up_drive() then also seems right thing
> >to do.
>
> Oh, ok.
>
> Jens, please apply this patch instead.
Too late, if you have other changes make them against current BK. I'd
say this one is cosmetic, though.
--
Jens Axboe
^ permalink raw reply [flat|nested] 4+ messages in thread
* [PATCH] check copy_from_user return value in sony535
@ 2003-10-06 13:53 Felipe W Damasio
2003-10-06 13:52 ` Jens Axboe
0 siblings, 1 reply; 4+ messages in thread
From: Felipe W Damasio @ 2003-10-06 13:53 UTC (permalink / raw)
To: Jens Axboe; +Cc: Linux Kernel Mailing List
[-- Attachment #1: Type: text/plain, Size: 197 bytes --]
Hi Jens,
Patch against 2.6.0-test6.
- Check the return value of copy_from_user on sony535 CDROM driver.
Found by smatch.
Following the local style, btw :)
Please apply,
Thanks.
Felipe
[-- Attachment #2: sonycd535-copy_from_user.patch --]
[-- Type: text/plain, Size: 491 bytes --]
--- linux-2.6.0-test6/drivers/cdrom/sonycd535.c.orig 2003-10-06 10:46:56.000000000 -0300
+++ linux-2.6.0-test6/drivers/cdrom/sonycd535.c 2003-10-06 10:48:20.000000000 -0300
@@ -1158,7 +1158,8 @@
return err;
spin_up_drive(status);
set_drive_mode(SONY535_AUDIO_DRIVE_MODE, status);
- copy_from_user(params, (void *)arg, 6);
+ if (copy_from_user(params, (void *)arg, 6))
+ return -EFAULT;
/* The parameters are given in int, must be converted */
for (i = 0; i < 3; i++) {
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2003-10-06 16:10 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <E1A6XJm-0003Vi-00.adobriyan-mail-ru@f20.mail.ru>
2003-10-06 16:05 ` [PATCH] check copy_from_user return value in sony535 Felipe W Damasio
2003-10-06 16:10 ` Jens Axboe
2003-10-06 13:53 Felipe W Damasio
2003-10-06 13:52 ` Jens Axboe
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox