lkml.org 
[lkml]   [2020]   [May]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
SubjectRe: [PATCH 11/20] amifb: get rid of pointless access_ok() calls
From
Date

Hi Al,

On 5/10/20 1:45 AM, Al Viro wrote:
> From: Al Viro <viro@zeniv.linux.org.uk>
>
> addresses passed only to get_user() and put_user()

This driver lacks checks for {get,put}_user() return values so it will
now return 0 ("success") even if {get,put}_user() fails.

Am I missing something?

> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
> ---
> drivers/video/fbdev/amifb.c | 4 ----
> 1 file changed, 4 deletions(-)
>
> diff --git a/drivers/video/fbdev/amifb.c b/drivers/video/fbdev/amifb.c
> index 20e03e00b66d..6062104f3afb 100644
> --- a/drivers/video/fbdev/amifb.c
> +++ b/drivers/video/fbdev/amifb.c
> @@ -1855,8 +1855,6 @@ static int ami_get_var_cursorinfo(struct fb_var_cursorinfo *var,
> var->yspot = par->crsr.spot_y;
> if (size > var->height * var->width)
> return -ENAMETOOLONG;
> - if (!access_ok(data, size))
> - return -EFAULT;
> delta = 1 << par->crsr.fmode;
> lspr = lofsprite + (delta << 1);
> if (par->bplcon0 & BPC0_LACE)
> @@ -1935,8 +1933,6 @@ static int ami_set_var_cursorinfo(struct fb_var_cursorinfo *var,
> return -EINVAL;
> if (!var->height)
> return -EINVAL;
> - if (!access_ok(data, var->width * var->height))
> - return -EFAULT;
> delta = 1 << fmode;
> lofsprite = shfsprite = (u_short *)spritememory;
> lspr = lofsprite + (delta << 1);
>

Best regards,
--
Bartlomiej Zolnierkiewicz
Samsung R&D Institute Poland
Samsung Electronics

\
 
 \ /
  Last update: 2020-05-14 15:46    [W:0.145 / U:0.248 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site