提交 cc1e66f9 编写于 作者: A Adam Borowski 提交者: Greg Kroah-Hartman

vt: use copy_from/to_user instead of __get/put_user for scrnmap ioctls

Linus wants to get rid of these functions, and these uses are especially
egregious: they copy a big linear array element by element.
Signed-off-by: NAdam Borowski <kilobyte@angband.pl>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
上级 3c2993b8
...@@ -322,15 +322,13 @@ int con_set_trans_old(unsigned char __user * arg) ...@@ -322,15 +322,13 @@ int con_set_trans_old(unsigned char __user * arg)
{ {
int i; int i;
unsigned short inbuf[E_TABSZ]; unsigned short inbuf[E_TABSZ];
unsigned char ubuf[E_TABSZ];
if (!access_ok(VERIFY_READ, arg, E_TABSZ)) if (copy_from_user(ubuf, arg, E_TABSZ))
return -EFAULT; return -EFAULT;
for (i = 0; i < E_TABSZ ; i++) { for (i = 0; i < E_TABSZ ; i++)
unsigned char uc; inbuf[i] = UNI_DIRECT_BASE | ubuf[i];
__get_user(uc, arg+i);
inbuf[i] = UNI_DIRECT_BASE | uc;
}
console_lock(); console_lock();
memcpy(translations[USER_MAP], inbuf, sizeof(inbuf)); memcpy(translations[USER_MAP], inbuf, sizeof(inbuf));
...@@ -345,9 +343,6 @@ int con_get_trans_old(unsigned char __user * arg) ...@@ -345,9 +343,6 @@ int con_get_trans_old(unsigned char __user * arg)
unsigned short *p = translations[USER_MAP]; unsigned short *p = translations[USER_MAP];
unsigned char outbuf[E_TABSZ]; unsigned char outbuf[E_TABSZ];
if (!access_ok(VERIFY_WRITE, arg, E_TABSZ))
return -EFAULT;
console_lock(); console_lock();
for (i = 0; i < E_TABSZ ; i++) for (i = 0; i < E_TABSZ ; i++)
{ {
...@@ -356,22 +351,16 @@ int con_get_trans_old(unsigned char __user * arg) ...@@ -356,22 +351,16 @@ int con_get_trans_old(unsigned char __user * arg)
} }
console_unlock(); console_unlock();
for (i = 0; i < E_TABSZ ; i++) return copy_to_user(arg, outbuf, sizeof(outbuf)) ? -EFAULT : 0;
__put_user(outbuf[i], arg+i);
return 0;
} }
int con_set_trans_new(ushort __user * arg) int con_set_trans_new(ushort __user * arg)
{ {
int i;
unsigned short inbuf[E_TABSZ]; unsigned short inbuf[E_TABSZ];
if (!access_ok(VERIFY_READ, arg, E_TABSZ*sizeof(unsigned short))) if (copy_from_user(inbuf, arg, sizeof(inbuf)))
return -EFAULT; return -EFAULT;
for (i = 0; i < E_TABSZ ; i++)
__get_user(inbuf[i], arg+i);
console_lock(); console_lock();
memcpy(translations[USER_MAP], inbuf, sizeof(inbuf)); memcpy(translations[USER_MAP], inbuf, sizeof(inbuf));
update_user_maps(); update_user_maps();
...@@ -381,19 +370,13 @@ int con_set_trans_new(ushort __user * arg) ...@@ -381,19 +370,13 @@ int con_set_trans_new(ushort __user * arg)
int con_get_trans_new(ushort __user * arg) int con_get_trans_new(ushort __user * arg)
{ {
int i;
unsigned short outbuf[E_TABSZ]; unsigned short outbuf[E_TABSZ];
if (!access_ok(VERIFY_WRITE, arg, E_TABSZ*sizeof(unsigned short)))
return -EFAULT;
console_lock(); console_lock();
memcpy(outbuf, translations[USER_MAP], sizeof(outbuf)); memcpy(outbuf, translations[USER_MAP], sizeof(outbuf));
console_unlock(); console_unlock();
for (i = 0; i < E_TABSZ ; i++) return copy_to_user(arg, outbuf, sizeof(outbuf)) ? -EFAULT : 0;
__put_user(outbuf[i], arg+i);
return 0;
} }
/* /*
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册