Skip to content

Commit 1f96bee

Browse files
Jarkko Sakkinendanvet
Jarkko Sakkinen
authored and
danvet
committed
drm: remove redundant code form drm_ioc32.c
The compat ioctl handler ends up calling access_ok() twice: first indirectly inside compat_alloc_user_space() and then after returning from that function. This patch fixes issue. v2: there were three invalid removals of access_ok() that I've fixed. Also went through all the changes couple of times and verified that access_ok() is only removed when the buffer is allocated with compat_alloc_user_space(). My deepest apologies for this kind of sloppiness! Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
1 parent e4f31ad commit 1f96bee

File tree

1 file changed

+26
-29
lines changed

1 file changed

+26
-29
lines changed

‎drivers/gpu/drm/drm_ioc32.c

Lines changed: 26 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -93,7 +93,7 @@ static int compat_drm_version(struct file *file, unsigned int cmd,
9393
return -EFAULT;
9494

9595
version = compat_alloc_user_space(sizeof(*version));
96-
if (!access_ok(VERIFY_WRITE, version, sizeof(*version)))
96+
if (!version)
9797
return -EFAULT;
9898
if (__put_user(v32.name_len, &version->name_len)
9999
|| __put_user((void __user *)(unsigned long)v32.name,
@@ -140,7 +140,7 @@ static int compat_drm_getunique(struct file *file, unsigned int cmd,
140140
return -EFAULT;
141141

142142
u = compat_alloc_user_space(sizeof(*u));
143-
if (!access_ok(VERIFY_WRITE, u, sizeof(*u)))
143+
if (!u)
144144
return -EFAULT;
145145
if (__put_user(uq32.unique_len, &u->unique_len)
146146
|| __put_user((void __user *)(unsigned long)uq32.unique,
@@ -168,7 +168,7 @@ static int compat_drm_setunique(struct file *file, unsigned int cmd,
168168
return -EFAULT;
169169

170170
u = compat_alloc_user_space(sizeof(*u));
171-
if (!access_ok(VERIFY_WRITE, u, sizeof(*u)))
171+
if (!u)
172172
return -EFAULT;
173173
if (__put_user(uq32.unique_len, &u->unique_len)
174174
|| __put_user((void __user *)(unsigned long)uq32.unique,
@@ -200,7 +200,7 @@ static int compat_drm_getmap(struct file *file, unsigned int cmd,
200200
return -EFAULT;
201201

202202
map = compat_alloc_user_space(sizeof(*map));
203-
if (!access_ok(VERIFY_WRITE, map, sizeof(*map)))
203+
if (!map)
204204
return -EFAULT;
205205
if (__put_user(idx, &map->offset))
206206
return -EFAULT;
@@ -237,7 +237,7 @@ static int compat_drm_addmap(struct file *file, unsigned int cmd,
237237
return -EFAULT;
238238

239239
map = compat_alloc_user_space(sizeof(*map));
240-
if (!access_ok(VERIFY_WRITE, map, sizeof(*map)))
240+
if (!map)
241241
return -EFAULT;
242242
if (__put_user(m32.offset, &map->offset)
243243
|| __put_user(m32.size, &map->size)
@@ -277,7 +277,7 @@ static int compat_drm_rmmap(struct file *file, unsigned int cmd,
277277
return -EFAULT;
278278

279279
map = compat_alloc_user_space(sizeof(*map));
280-
if (!access_ok(VERIFY_WRITE, map, sizeof(*map)))
280+
if (!map)
281281
return -EFAULT;
282282
if (__put_user((void *)(unsigned long)handle, &map->handle))
283283
return -EFAULT;
@@ -306,7 +306,7 @@ static int compat_drm_getclient(struct file *file, unsigned int cmd,
306306
return -EFAULT;
307307

308308
client = compat_alloc_user_space(sizeof(*client));
309-
if (!access_ok(VERIFY_WRITE, client, sizeof(*client)))
309+
if (!client)
310310
return -EFAULT;
311311
if (__put_user(idx, &client->idx))
312312
return -EFAULT;
@@ -345,7 +345,7 @@ static int compat_drm_getstats(struct file *file, unsigned int cmd,
345345
int i, err;
346346

347347
stats = compat_alloc_user_space(sizeof(*stats));
348-
if (!access_ok(VERIFY_WRITE, stats, sizeof(*stats)))
348+
if (!stats)
349349
return -EFAULT;
350350

351351
err = drm_ioctl(file, DRM_IOCTL_GET_STATS, (unsigned long)stats);
@@ -382,8 +382,7 @@ static int compat_drm_addbufs(struct file *file, unsigned int cmd,
382382
unsigned long agp_start;
383383

384384
buf = compat_alloc_user_space(sizeof(*buf));
385-
if (!access_ok(VERIFY_WRITE, buf, sizeof(*buf))
386-
|| !access_ok(VERIFY_WRITE, argp, sizeof(*argp)))
385+
if (!buf || !access_ok(VERIFY_WRITE, argp, sizeof(*argp)))
387386
return -EFAULT;
388387

389388
if (__copy_in_user(buf, argp, offsetof(drm_buf_desc32_t, agp_start))
@@ -414,7 +413,7 @@ static int compat_drm_markbufs(struct file *file, unsigned int cmd,
414413
return -EFAULT;
415414

416415
buf = compat_alloc_user_space(sizeof(*buf));
417-
if (!access_ok(VERIFY_WRITE, buf, sizeof(*buf)))
416+
if (!buf)
418417
return -EFAULT;
419418

420419
if (__put_user(b32.size, &buf->size)
@@ -455,7 +454,7 @@ static int compat_drm_infobufs(struct file *file, unsigned int cmd,
455454

456455
nbytes = sizeof(*request) + count * sizeof(struct drm_buf_desc);
457456
request = compat_alloc_user_space(nbytes);
458-
if (!access_ok(VERIFY_WRITE, request, nbytes))
457+
if (!request)
459458
return -EFAULT;
460459
list = (struct drm_buf_desc *) (request + 1);
461460

@@ -516,7 +515,7 @@ static int compat_drm_mapbufs(struct file *file, unsigned int cmd,
516515
return -EINVAL;
517516
nbytes = sizeof(*request) + count * sizeof(struct drm_buf_pub);
518517
request = compat_alloc_user_space(nbytes);
519-
if (!access_ok(VERIFY_WRITE, request, nbytes))
518+
if (!request)
520519
return -EFAULT;
521520
list = (struct drm_buf_pub *) (request + 1);
522521

@@ -563,7 +562,7 @@ static int compat_drm_freebufs(struct file *file, unsigned int cmd,
563562
return -EFAULT;
564563

565564
request = compat_alloc_user_space(sizeof(*request));
566-
if (!access_ok(VERIFY_WRITE, request, sizeof(*request)))
565+
if (!request)
567566
return -EFAULT;
568567
if (__put_user(req32.count, &request->count)
569568
|| __put_user((int __user *)(unsigned long)req32.list,
@@ -589,7 +588,7 @@ static int compat_drm_setsareactx(struct file *file, unsigned int cmd,
589588
return -EFAULT;
590589

591590
request = compat_alloc_user_space(sizeof(*request));
592-
if (!access_ok(VERIFY_WRITE, request, sizeof(*request)))
591+
if (!request)
593592
return -EFAULT;
594593
if (__put_user(req32.ctx_id, &request->ctx_id)
595594
|| __put_user((void *)(unsigned long)req32.handle,
@@ -613,7 +612,7 @@ static int compat_drm_getsareactx(struct file *file, unsigned int cmd,
613612
return -EFAULT;
614613

615614
request = compat_alloc_user_space(sizeof(*request));
616-
if (!access_ok(VERIFY_WRITE, request, sizeof(*request)))
615+
if (!request)
617616
return -EFAULT;
618617
if (__put_user(ctx_id, &request->ctx_id))
619618
return -EFAULT;
@@ -646,7 +645,7 @@ static int compat_drm_resctx(struct file *file, unsigned int cmd,
646645
return -EFAULT;
647646

648647
res = compat_alloc_user_space(sizeof(*res));
649-
if (!access_ok(VERIFY_WRITE, res, sizeof(*res)))
648+
if (!res)
650649
return -EFAULT;
651650
if (__put_user(res32.count, &res->count)
652651
|| __put_user((struct drm_ctx __user *) (unsigned long)res32.contexts,
@@ -689,7 +688,7 @@ static int compat_drm_dma(struct file *file, unsigned int cmd,
689688
return -EFAULT;
690689

691690
d = compat_alloc_user_space(sizeof(*d));
692-
if (!access_ok(VERIFY_WRITE, d, sizeof(*d)))
691+
if (!d)
693692
return -EFAULT;
694693

695694
if (__put_user(d32.context, &d->context)
@@ -764,7 +763,7 @@ static int compat_drm_agp_info(struct file *file, unsigned int cmd,
764763
int err;
765764

766765
info = compat_alloc_user_space(sizeof(*info));
767-
if (!access_ok(VERIFY_WRITE, info, sizeof(*info)))
766+
if (!info)
768767
return -EFAULT;
769768

770769
err = drm_ioctl(file, DRM_IOCTL_AGP_INFO, (unsigned long)info);
@@ -807,7 +806,7 @@ static int compat_drm_agp_alloc(struct file *file, unsigned int cmd,
807806
return -EFAULT;
808807

809808
request = compat_alloc_user_space(sizeof(*request));
810-
if (!access_ok(VERIFY_WRITE, request, sizeof(*request))
809+
if (!request
811810
|| __put_user(req32.size, &request->size)
812811
|| __put_user(req32.type, &request->type))
813812
return -EFAULT;
@@ -834,7 +833,7 @@ static int compat_drm_agp_free(struct file *file, unsigned int cmd,
834833
u32 handle;
835834

836835
request = compat_alloc_user_space(sizeof(*request));
837-
if (!access_ok(VERIFY_WRITE, request, sizeof(*request))
836+
if (!request
838837
|| get_user(handle, &argp->handle)
839838
|| __put_user(handle, &request->handle))
840839
return -EFAULT;
@@ -858,7 +857,7 @@ static int compat_drm_agp_bind(struct file *file, unsigned int cmd,
858857
return -EFAULT;
859858

860859
request = compat_alloc_user_space(sizeof(*request));
861-
if (!access_ok(VERIFY_WRITE, request, sizeof(*request))
860+
if (!request
862861
|| __put_user(req32.handle, &request->handle)
863862
|| __put_user(req32.offset, &request->offset))
864863
return -EFAULT;
@@ -874,7 +873,7 @@ static int compat_drm_agp_unbind(struct file *file, unsigned int cmd,
874873
u32 handle;
875874

876875
request = compat_alloc_user_space(sizeof(*request));
877-
if (!access_ok(VERIFY_WRITE, request, sizeof(*request))
876+
if (!request
878877
|| get_user(handle, &argp->handle)
879878
|| __put_user(handle, &request->handle))
880879
return -EFAULT;
@@ -897,8 +896,7 @@ static int compat_drm_sg_alloc(struct file *file, unsigned int cmd,
897896
unsigned long x;
898897

899898
request = compat_alloc_user_space(sizeof(*request));
900-
if (!access_ok(VERIFY_WRITE, request, sizeof(*request))
901-
|| !access_ok(VERIFY_WRITE, argp, sizeof(*argp))
899+
if (!request || !access_ok(VERIFY_WRITE, argp, sizeof(*argp))
902900
|| __get_user(x, &argp->size)
903901
|| __put_user(x, &request->size))
904902
return -EFAULT;
@@ -923,8 +921,7 @@ static int compat_drm_sg_free(struct file *file, unsigned int cmd,
923921
unsigned long x;
924922

925923
request = compat_alloc_user_space(sizeof(*request));
926-
if (!access_ok(VERIFY_WRITE, request, sizeof(*request))
927-
|| !access_ok(VERIFY_WRITE, argp, sizeof(*argp))
924+
if (!request || !access_ok(VERIFY_WRITE, argp, sizeof(*argp))
928925
|| __get_user(x, &argp->handle)
929926
|| __put_user(x << PAGE_SHIFT, &request->handle))
930927
return -EFAULT;
@@ -952,7 +949,7 @@ static int compat_drm_update_draw(struct file *file, unsigned int cmd,
952949
return -EFAULT;
953950

954951
request = compat_alloc_user_space(sizeof(*request));
955-
if (!access_ok(VERIFY_WRITE, request, sizeof(*request)) ||
952+
if (!request ||
956953
__put_user(update32.handle, &request->handle) ||
957954
__put_user(update32.type, &request->type) ||
958955
__put_user(update32.num, &request->num) ||
@@ -994,7 +991,7 @@ static int compat_drm_wait_vblank(struct file *file, unsigned int cmd,
994991
return -EFAULT;
995992

996993
request = compat_alloc_user_space(sizeof(*request));
997-
if (!access_ok(VERIFY_WRITE, request, sizeof(*request))
994+
if (!request
998995
|| __put_user(req32.request.type, &request->request.type)
999996
|| __put_user(req32.request.sequence, &request->request.sequence)
1000997
|| __put_user(req32.request.signal, &request->request.signal))

0 commit comments

Comments
 (0)