Commit f4a4c86b authored by Alexander Viro's avatar Alexander Viro Committed by Linus Torvalds

[PATCH] isdn_writebuf_stub() sanitized

isdn_writebuf_stub() was always called for userland pointers.

Killed the argument telling whether it's kernel or userland pointer,
killed dead code, updated callers.
parent 1d9086ac
...@@ -1072,7 +1072,7 @@ isdn_write(struct file *file, const char *buf, size_t count, loff_t * off) ...@@ -1072,7 +1072,7 @@ isdn_write(struct file *file, const char *buf, size_t count, loff_t * off)
goto out; goto out;
} }
chidx = isdn_minor2chan(minor); chidx = isdn_minor2chan(minor);
while (isdn_writebuf_stub(drvidx, chidx, buf, count, 1) != count) while (isdn_writebuf_stub(drvidx, chidx, buf, count) != count)
interruptible_sleep_on(&dev->drv[drvidx]->snd_waitq[chidx]); interruptible_sleep_on(&dev->drv[drvidx]->snd_waitq[chidx]);
retval = count; retval = count;
goto out; goto out;
...@@ -1838,8 +1838,7 @@ isdn_unexclusive_channel(int di, int ch) ...@@ -1838,8 +1838,7 @@ isdn_unexclusive_channel(int di, int ch)
* writebuf replacement for SKB_ABLE drivers * writebuf replacement for SKB_ABLE drivers
*/ */
static int static int
isdn_writebuf_stub(int drvidx, int chan, const u_char * buf, int len, isdn_writebuf_stub(int drvidx, int chan, const u_char __user * buf, int len)
int user)
{ {
int ret; int ret;
int hl = dev->drv[drvidx]->interface->hl_hdrlen; int hl = dev->drv[drvidx]->interface->hl_hdrlen;
...@@ -1848,10 +1847,7 @@ isdn_writebuf_stub(int drvidx, int chan, const u_char * buf, int len, ...@@ -1848,10 +1847,7 @@ isdn_writebuf_stub(int drvidx, int chan, const u_char * buf, int len,
if (!skb) if (!skb)
return 0; return 0;
skb_reserve(skb, hl); skb_reserve(skb, hl);
if (user) copy_from_user(skb_put(skb, len), buf, len);
copy_from_user(skb_put(skb, len), buf, len);
else
memcpy(skb_put(skb, len), buf, len);
ret = dev->drv[drvidx]->interface->writebuf_skb(drvidx, chan, 1, skb); ret = dev->drv[drvidx]->interface->writebuf_skb(drvidx, chan, 1, skb);
if (ret <= 0) if (ret <= 0)
dev_kfree_skb(skb); dev_kfree_skb(skb);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment