[PATCH 5/9] Add bound checks in acpi/video for copy_from_user

Arjan van de Ven
2009-09-26T18:54:24Z

Subject: [PATCH 5/9] Add bound checks in acpi/video for copy_from_user
CC: Len Brown <lenb@kernel.org>

The ACPI video driver has a few boundary checks for copy_from_user
that unfortunately confuse the GCC optimizer.

This patch simplifies these boundary checks to the point that
gcc knows they copy_from_user() is always within bounds.

Signed-off-by: Arjan van de Ven <arjan@linux.intel.com>

diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c
index 94b1a4c..0dd2cc8 100644
--- a/drivers/acpi/video.c
+++ b/drivers/acpi/video.c
@@ -1218,7 +1218,9 @@ acpi_video_device_write_state(struct file *file,
u32 state = 0;

- if (!dev || count + 1 > sizeof str)
+ if (!dev)
+ return -EINVAL;
+ if (count >= sizeof(str))
return -EINVAL;

if (copy_from_user(str, buffer, count))
@@ -1275,7 +1277,10 @@ acpi_video_device_write_brightness(struct file *file,
int i;

- if (!dev || !dev->brightness || count + 1 > sizeof str)
+ if (!dev || !dev->brightness)
+ return -EINVAL;
+
+ if (count >= sizeof(str))
return -EINVAL;

if (copy_from_user(str, buffer, count))
@@ -1557,7 +1562,10 @@ acpi_video_bus_write_POST(struct file *file,
unsigned long long opt, options;

- if (!video || count + 1 > sizeof str)
+ if (!video)
+ return -EINVAL;
+
+ if (count >= sizeof(str))
return -EINVAL;

status = acpi_video_bus_POST_options(video, &options);
@@ -1597,7 +1605,9 @@ acpi_video_bus_write_DOS(struct file *file,
unsigned long opt;

- if (!video || count + 1 > sizeof str)
+ if (!video)
+ return -EINVAL;
+ if (count >= sizeof(str))
return -EINVAL;

if (copy_from_user(str, buffer, count))