cdrom: use copy_to_user() without the underscores
"nframes" comes from the user and "nframes * CD_FRAMESIZE_RAW" can wrap on 32 bit systems. That would have been ok if we used the same wrapped value for the copy, but we use a shifted value. We should just use the checked version of copy_to_user() because it's not going to make a difference to the speed. Cc: stable@vger.kernel.com Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
This commit is contained in:
parent
9fa73472dd
commit
822bfa51ce
1 changed files with 1 additions and 7 deletions
|
@ -2119,11 +2119,6 @@ static int cdrom_read_cdda_old(struct cdrom_device_info *cdi, __u8 __user *ubuf,
|
||||||
if (!nr)
|
if (!nr)
|
||||||
return -ENOMEM;
|
return -ENOMEM;
|
||||||
|
|
||||||
if (!access_ok(VERIFY_WRITE, ubuf, nframes * CD_FRAMESIZE_RAW)) {
|
|
||||||
ret = -EFAULT;
|
|
||||||
goto out;
|
|
||||||
}
|
|
||||||
|
|
||||||
cgc.data_direction = CGC_DATA_READ;
|
cgc.data_direction = CGC_DATA_READ;
|
||||||
while (nframes > 0) {
|
while (nframes > 0) {
|
||||||
if (nr > nframes)
|
if (nr > nframes)
|
||||||
|
@ -2132,7 +2127,7 @@ static int cdrom_read_cdda_old(struct cdrom_device_info *cdi, __u8 __user *ubuf,
|
||||||
ret = cdrom_read_block(cdi, &cgc, lba, nr, 1, CD_FRAMESIZE_RAW);
|
ret = cdrom_read_block(cdi, &cgc, lba, nr, 1, CD_FRAMESIZE_RAW);
|
||||||
if (ret)
|
if (ret)
|
||||||
break;
|
break;
|
||||||
if (__copy_to_user(ubuf, cgc.buffer, CD_FRAMESIZE_RAW * nr)) {
|
if (copy_to_user(ubuf, cgc.buffer, CD_FRAMESIZE_RAW * nr)) {
|
||||||
ret = -EFAULT;
|
ret = -EFAULT;
|
||||||
break;
|
break;
|
||||||
}
|
}
|
||||||
|
@ -2140,7 +2135,6 @@ static int cdrom_read_cdda_old(struct cdrom_device_info *cdi, __u8 __user *ubuf,
|
||||||
nframes -= nr;
|
nframes -= nr;
|
||||||
lba += nr;
|
lba += nr;
|
||||||
}
|
}
|
||||||
out:
|
|
||||||
kfree(cgc.buffer);
|
kfree(cgc.buffer);
|
||||||
return ret;
|
return ret;
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in a new issue