lkml.org 
[lkml]   [2009]   [Sep]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[PATCH 5/9] Add bound checks in acpi/video for copy_from_user
    From: Arjan van de Ven <arjan@linux.intel.com>
    Subject: [PATCH 5/9] Add bound checks in acpi/video for copy_from_user
    CC: Len Brown <lenb@kernel.org>

    The ACPI video driver has a few boundary checks for copy_from_user
    that unfortunately confuse the GCC optimizer.

    This patch simplifies these boundary checks to the point that
    gcc knows they copy_from_user() is always within bounds.

    Signed-off-by: Arjan van de Ven <arjan@linux.intel.com>


    diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c
    index 94b1a4c..0dd2cc8 100644
    --- a/drivers/acpi/video.c
    +++ b/drivers/acpi/video.c
    @@ -1218,7 +1218,9 @@ acpi_video_device_write_state(struct file *file,
    u32 state = 0;


    - if (!dev || count + 1 > sizeof str)
    + if (!dev)
    + return -EINVAL;
    + if (count >= sizeof(str))
    return -EINVAL;

    if (copy_from_user(str, buffer, count))
    @@ -1275,7 +1277,10 @@ acpi_video_device_write_brightness(struct file *file,
    int i;


    - if (!dev || !dev->brightness || count + 1 > sizeof str)
    + if (!dev || !dev->brightness)
    + return -EINVAL;
    +
    + if (count >= sizeof(str))
    return -EINVAL;

    if (copy_from_user(str, buffer, count))
    @@ -1557,7 +1562,10 @@ acpi_video_bus_write_POST(struct file *file,
    unsigned long long opt, options;


    - if (!video || count + 1 > sizeof str)
    + if (!video)
    + return -EINVAL;
    +
    + if (count >= sizeof(str))
    return -EINVAL;

    status = acpi_video_bus_POST_options(video, &options);
    @@ -1597,7 +1605,9 @@ acpi_video_bus_write_DOS(struct file *file,
    unsigned long opt;


    - if (!video || count + 1 > sizeof str)
    + if (!video)
    + return -EINVAL;
    + if (count >= sizeof(str))
    return -EINVAL;

    if (copy_from_user(str, buffer, count))


    --
    Arjan van de Ven Intel Open Source Technology Centre
    For development, discussion and tips for power savings,
    visit http://www.lesswatts.org


    \
     
     \ /
      Last update: 2009-09-26 20:57    [W:0.021 / U:11.696 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site