Hi Al,
On 5/10/20 1:45 AM, Al Viro wrote:
> From: Al Viro <viro@xxxxxxxxxxxxxxxxxx>
>
> addresses passed only to get_user() and put_user()
This driver lacks checks for {get,put}_user() return values so it will
now return 0 ("success") even if {get,put}_user() fails.
Am I missing something?
> Signed-off-by: Al Viro <viro@xxxxxxxxxxxxxxxxxx>
> ---
> drivers/video/fbdev/amifb.c | 4 ----
> 1 file changed, 4 deletions(-)
>
> diff --git a/drivers/video/fbdev/amifb.c b/drivers/video/fbdev/amifb.c
> index 20e03e00b66d..6062104f3afb 100644
> --- a/drivers/video/fbdev/amifb.c
> +++ b/drivers/video/fbdev/amifb.c
> @@ -1855,8 +1855,6 @@ static int ami_get_var_cursorinfo(struct fb_var_cursorinfo *var,
> var->yspot = par->crsr.spot_y;
> if (size > var->height * var->width)
> return -ENAMETOOLONG;
> - if (!access_ok(data, size))
> - return -EFAULT;
> delta = 1 << par->crsr.fmode;
> lspr = lofsprite + (delta << 1);
> if (par->bplcon0 & BPC0_LACE)
> @@ -1935,8 +1933,6 @@ static int ami_set_var_cursorinfo(struct fb_var_cursorinfo *var,
> return -EINVAL;
> if (!var->height)
> return -EINVAL;
> - if (!access_ok(data, var->width * var->height))
> - return -EFAULT;
> delta = 1 << fmode;
> lofsprite = shfsprite = (u_short *)spritememory;
> lspr = lofsprite + (delta << 1);
>
Best regards,
--
Bartlomiej Zolnierkiewicz
Samsung R&D Institute Poland
Samsung Electronics
