Re: [2.6.7-rc1-mm1] lp int copy_to_user replaced

[FabF <fabian.frederick@skynet.be>]

[-- Attachment #1: Type: text/plain, Size: 391 bytes --]

Here it is.

FabF

On Thu, 2004-05-27 at 19:39, Arjan van de Ven wrote:
> On Thu, 2004-05-27 at 19:32, FabF wrote:
> > Andrew,
> > 
> > 	Here's a patch to have standard __put_user for integer transfers in lp
> > driver.Is it correct ?
> 
> no it's not. You need to use put_user() not __put_user() at least, to
> make sure the destination address is checked to not be in kernel
> space...
> 

[-- Attachment #2: lp2.diff --]
[-- Type: text/x-patch, Size: 1244 bytes --]

diff -Naur orig/drivers/char/lp.c edited/drivers/char/lp.c
--- orig/drivers/char/lp.c	2004-05-10 04:31:58.000000000 +0200
+++ edited/drivers/char/lp.c	2004-05-27 19:43:43.649316720 +0200
@@ -31,6 +31,8 @@
  * Obsoleted and removed all the lowlevel stuff implemented in the last
  * month to use the IEEE1284 functions (that handle the _new_ compatibilty
  * mode fine).
+ *
+ * 27-MAY-2004  Replace int copy_to_user with put_user (Fabian Frederick)
  */
 
 /* This driver should, in theory, work with any parallel port that has an
@@ -603,16 +605,14 @@
 			return -EINVAL;
 			break;
 		case LPGETIRQ:
-			if (copy_to_user((int *) arg, &LP_IRQ(minor),
-					sizeof(int)))
+			if (put_user(LP_IRQ(minor), (int *) arg))
 				return -EFAULT;
 			break;
 		case LPGETSTATUS:
 			lp_claim_parport_or_block (&lp_table[minor]);
 			status = r_str(minor);
 			lp_release_parport (&lp_table[minor]);
-
-			if (copy_to_user((int *) arg, &status, sizeof(int)))
+			if (put_user(status, (int *) arg))
 				return -EFAULT;
 			break;
 		case LPRESET:
@@ -630,7 +630,7 @@
 #endif
  		case LPGETFLAGS:
  			status = LP_F(minor);
-			if (copy_to_user((int *) arg, &status, sizeof(int)))
+			if (put_user(status, (int *) arg))
 				return -EFAULT;
 			break;