Re: [PATCH] check copy_from_user return value in sony535

Re: [PATCH] check copy_from_user return value in sony535

[Jens Axboe]

On Mon, Oct 06 2003, Felipe W Damasio wrote:
> 	Hi Jens,
> 
> 	Patch against 2.6.0-test6.
> 
> 	- Check the return value of copy_from_user on sony535 CDROM driver. 
> Found by smatch.

Looks fine, thanks.

> 	Following the local style, btw :)

Appreciated :)

-- 
Jens Axboe

[PATCH] check copy_from_user return value in sony535

[Felipe W Damasio]

[-- Attachment #1: Type: text/plain, Size: 197 bytes --]

	Hi Jens,

	Patch against 2.6.0-test6.

	- Check the return value of copy_from_user on sony535 CDROM driver. 
Found by smatch.

	Following the local style, btw :)

	Please apply,

	Thanks.

Felipe

[-- Attachment #2: sonycd535-copy_from_user.patch --]
[-- Type: text/plain, Size: 491 bytes --]

--- linux-2.6.0-test6/drivers/cdrom/sonycd535.c.orig	2003-10-06 10:46:56.000000000 -0300
+++ linux-2.6.0-test6/drivers/cdrom/sonycd535.c	2003-10-06 10:48:20.000000000 -0300
@@ -1158,7 +1158,8 @@
 			return err;
 		spin_up_drive(status);
 		set_drive_mode(SONY535_AUDIO_DRIVE_MODE, status);
-		copy_from_user(params, (void *)arg, 6);
+		if (copy_from_user(params, (void *)arg, 6))
+			return -EFAULT;
 
 		/* The parameters are given in int, must be converted */
 		for (i = 0; i < 3; i++) {

Re: [PATCH] check copy_from_user return value in sony535

[Felipe W Damasio]

[-- Attachment #1: Type: text/plain, Size: 273 bytes --]

	Hi Alexey,

Alexey Dobriyan wrote:
> Fell free to nuke verify_area() right before 'return err;' ;-)

	Right :)

> Moving copy_from_user() before spin_up_drive() then also seems right thing to do.

	Oh, ok.

	Jens, please apply this patch instead.

	Thanks Alexey,

Felipe

[-- Attachment #2: sonycd535-copy_from_user.patch --]
[-- Type: text/plain, Size: 637 bytes --]

--- linux-2.6.0-test6/drivers/cdrom/sonycd535.c.orig	2003-10-06 10:46:56.000000000 -0300
+++ linux-2.6.0-test6/drivers/cdrom/sonycd535.c	2003-10-06 13:03:13.000000000 -0300
@@ -1153,12 +1153,10 @@
 		break;
 
 	case CDROMPLAYMSF:			/* Play starting at the given MSF address. */
-		err = verify_area(VERIFY_READ, (char *)arg, 6);
-		if (err)
-			return err;
+		if (copy_from_user(params, (void *)arg, 6))
+			return -EFAULT;
 		spin_up_drive(status);
 		set_drive_mode(SONY535_AUDIO_DRIVE_MODE, status);
-		copy_from_user(params, (void *)arg, 6);
 
 		/* The parameters are given in int, must be converted */
 		for (i = 0; i < 3; i++) {

Re: [PATCH] check copy_from_user return value in sony535

[Jens Axboe]

On Mon, Oct 06 2003, Felipe W Damasio wrote:
> 	Hi Alexey,
> 
> Alexey Dobriyan wrote:
> >Fell free to nuke verify_area() right before 'return err;' ;-)
> 
> 	Right :)
> 
> >Moving copy_from_user() before spin_up_drive() then also seems right thing 
> >to do.
> 
> 	Oh, ok.
> 
> 	Jens, please apply this patch instead.

Too late, if you have other changes make them against current BK. I'd
say this one is cosmetic, though.

-- 
Jens Axboe