[PATCH 04/11] Get rid of verify_area() - drivers part 1, approximatelyfirst half of drivers/.

From: Jesper Juhl
Date: Mon Jan 17 2005 - 20:35:17 EST


Convert a bunch of verify_area()'s to access_ok().
Drivers part 1, approximately first half of drivers/.


Signed-off-by: Jesper Juhl <juhl-lkml@xxxxxx>

--- linux-2.6.11-rc1-bk4-orig/drivers/tc/zs.c 2004-12-24 22:35:25.000000000 +0100
+++ linux-2.6.11-rc1-bk4/drivers/tc/zs.c 2005-01-17 20:30:12.000000000 +0100
@@ -1267,28 +1267,25 @@ static int rs_ioctl(struct tty_struct *t

switch (cmd) {
case TIOCGSERIAL:
- error = verify_area(VERIFY_WRITE, (void *) arg,
- sizeof(struct serial_struct));
- if (error)
- return error;
- return get_serial_info(info,
- (struct serial_struct *) arg);
+ if (access_ok(VERIFY_WRITE, (void *) arg,
+ sizeof(struct serial_struct)))
+ return get_serial_info(info,
+ (struct serial_struct *) arg);
+ else
+ return -EFAULT;
case TIOCSSERIAL:
return set_serial_info(info,
(struct serial_struct *) arg);
case TIOCSERGETLSR: /* Get line status register */
- error = verify_area(VERIFY_WRITE, (void *) arg,
- sizeof(unsigned int));
- if (error)
- return error;
+ if (access_ok(VERIFY_WRITE, (void *) arg,
+ sizeof(unsigned int)))
+ return get_lsr_info(info, (unsigned int *) arg);
else
- return get_lsr_info(info, (unsigned int *) arg);
-
+ return -EFAULT;
case TIOCSERGSTRUCT:
- error = verify_area(VERIFY_WRITE, (void *) arg,
- sizeof(struct dec_serial));
- if (error)
- return error;
+ if (!access_ok(VERIFY_WRITE, (void *) arg,
+ sizeof(struct dec_serial)))
+ return -EFAULT;
copy_from_user((struct dec_serial *) arg,
info, sizeof(struct dec_serial));
return 0;
--- linux-2.6.11-rc1-bk4-orig/drivers/net/wireless/orinoco.c 2005-01-16 21:27:12.000000000 +0100
+++ linux-2.6.11-rc1-bk4/drivers/net/wireless/orinoco.c 2005-01-17 20:30:59.000000000 +0100
@@ -2553,9 +2553,8 @@ static int orinoco_ioctl_getiwrange(stru

TRACE_ENTER(dev->name);

- err = verify_area(VERIFY_WRITE, rrq->pointer, sizeof(range));
- if (err)
- return err;
+ if (!access_ok(VERIFY_WRITE, rrq->pointer, sizeof(range)))
+ return -EFAULT;

rrq->length = sizeof(range);

--- linux-2.6.11-rc1-bk4-orig/drivers/mtd/mtdchar.c 2005-01-12 23:26:12.000000000 +0100
+++ linux-2.6.11-rc1-bk4/drivers/mtd/mtdchar.c 2005-01-17 20:34:46.000000000 +0100
@@ -285,12 +285,12 @@ static int mtd_ioctl(struct inode *inode

size = (cmd & IOCSIZE_MASK) >> IOCSIZE_SHIFT;
if (cmd & IOC_IN) {
- ret = verify_area(VERIFY_READ, argp, size);
- if (ret) return ret;
+ if (!access_ok(VERIFY_READ, argp, size))
+ return -EFAULT;
}
if (cmd & IOC_OUT) {
- ret = verify_area(VERIFY_WRITE, argp, size);
- if (ret) return ret;
+ if (!access_ok(VERIFY_WRITE, argp, size))
+ return -EFAULT;
}

switch (cmd) {
@@ -389,7 +389,8 @@ static int mtd_ioctl(struct inode *inode
if (!mtd->write_oob)
ret = -EOPNOTSUPP;
else
- ret = verify_area(VERIFY_READ, buf.ptr, buf.length);
+ ret = access_ok(VERIFY_READ, buf.ptr,
+ buf.length) ? 0 : EFAULT;

if (ret)
return ret;
@@ -428,7 +429,8 @@ static int mtd_ioctl(struct inode *inode
if (!mtd->read_oob)
ret = -EOPNOTSUPP;
else
- ret = verify_area(VERIFY_WRITE, buf.ptr, buf.length);
+ ret = access_ok(VERIFY_WRITE, buf.ptr,
+ buf.length) ? 0 : -EFAULT;

if (ret)
return ret;
--- linux-2.6.11-rc1-bk4-orig/drivers/usb/serial/kl5kusb105.c 2004-12-24 22:34:58.000000000 +0100
+++ linux-2.6.11-rc1-bk4/drivers/usb/serial/kl5kusb105.c 2005-01-17 20:39:56.000000000 +0100
@@ -925,45 +925,34 @@ static int klsi_105_ioctl (struct usb_se
/* TODO */
dbg("%s - TIOCMIWAIT not handled", __FUNCTION__);
return -ENOIOCTLCMD;
-
case TIOCGICOUNT:
/* return count of modemline transitions */
/* TODO */
dbg("%s - TIOCGICOUNT not handled", __FUNCTION__);
return -ENOIOCTLCMD;
- case TCGETS: {
- /* return current info to caller */
- int retval;
-
- dbg("%s - TCGETS data faked/incomplete", __FUNCTION__);
-
- retval = verify_area(VERIFY_WRITE, user_arg,
- sizeof(struct termios));
- if (retval)
- return retval;
-
- if (kernel_termios_to_user_termios((struct termios __user *)arg,
- &priv->termios))
- return -EFAULT;
- return(0);
- }
- case TCSETS: {
- /* set port termios to the one given by the user */
- int retval;
+ case TCGETS:
+ /* return current info to caller */
+ dbg("%s - TCGETS data faked/incomplete", __FUNCTION__);
+
+ if (!access_ok(VERIFY_WRITE, user_arg, sizeof(struct termios)))
+ return -EFAULT;

+ if (kernel_termios_to_user_termios((struct termios __user *)arg,
+ &priv->termios))
+ return -EFAULT;
+ return 0;
+ case TCSETS:
+ /* set port termios to the one given by the user */
dbg("%s - TCSETS not handled", __FUNCTION__);

- retval = verify_area(VERIFY_READ, user_arg,
- sizeof(struct termios));
- if (retval)
- return retval;
+ if (!access_ok(VERIFY_READ, user_arg, sizeof(struct termios)))
+ return -EFAULT;

if (user_termios_to_kernel_termios(&priv->termios,
- (struct termios __user *)arg))
+ (struct termios __user *)arg))
return -EFAULT;
klsi_105_set_termios(port, &priv->termios);
- return(0);
- }
+ return 0;
case TCSETSW: {
/* set port termios and try to wait for completion of last
* write operation */
--- linux-2.6.11-rc1-bk4-orig/drivers/usb/serial/kobil_sct.c 2005-01-12 23:26:21.000000000 +0100
+++ linux-2.6.11-rc1-bk4/drivers/usb/serial/kobil_sct.c 2005-01-17 20:42:03.000000000 +0100
@@ -637,10 +637,9 @@ static int kobil_ioctl(struct usb_seria

switch (cmd) {
case TCGETS: // 0x5401
- result = verify_area(VERIFY_WRITE, user_arg, sizeof(struct termios));
- if (result) {
- dbg("%s - port %d Error in verify_area", __FUNCTION__, port->number);
- return(result);
+ if (!access_ok(VERIFY_WRITE, user_arg, sizeof(struct termios))) {
+ dbg("%s - port %d Error in access_ok", __FUNCTION__, port->number);
+ return -EFAULT;
}
if (kernel_termios_to_user_termios((struct termios __user *)arg,
&priv->internal_termios))
@@ -652,10 +651,9 @@ static int kobil_ioctl(struct usb_seria
dbg("%s - port %d Error: port->tty->termios is NULL", __FUNCTION__, port->number);
return -ENOTTY;
}
- result = verify_area(VERIFY_READ, user_arg, sizeof(struct termios));
- if (result) {
- dbg("%s - port %d Error in verify_area", __FUNCTION__, port->number);
- return result;
+ if (!access_ok(VERIFY_READ, user_arg, sizeof(struct termios))) {
+ dbg("%s - port %d Error in access_ok", __FUNCTION__, port->number);
+ return -EFAULT;
}
if (user_termios_to_kernel_termios(&priv->internal_termios,
(struct termios __user *)arg))
--- linux-2.6.11-rc1-bk4-orig/drivers/char/rio/rio_linux.c 2005-01-12 23:26:11.000000000 +0100
+++ linux-2.6.11-rc1-bk4/drivers/char/rio/rio_linux.c 2005-01-17 21:02:23.000000000 +0100
@@ -681,8 +681,9 @@ static int rio_ioctl (struct tty_struct
}
break;
case TIOCGSERIAL:
- if ((rc = verify_area(VERIFY_WRITE, (void *) arg,
- sizeof(struct serial_struct))) == 0)
+ rc = -EFAULT;
+ if (access_ok(VERIFY_WRITE, (void *) arg,
+ sizeof(struct serial_struct)))
rc = gs_getserial(&PortP->gs, (struct serial_struct *) arg);
break;
case TCSBRK:
@@ -711,8 +712,9 @@ static int rio_ioctl (struct tty_struct
}
break;
case TIOCSSERIAL:
- if ((rc = verify_area(VERIFY_READ, (void *) arg,
- sizeof(struct serial_struct))) == 0)
+ rc = -EFAULT;
+ if (access_ok(VERIFY_READ, (void *) arg,
+ sizeof(struct serial_struct)))
rc = gs_setserial(&PortP->gs, (struct serial_struct *) arg);
break;
#if 0
@@ -722,8 +724,10 @@ static int rio_ioctl (struct tty_struct
* #if 0 disablement predates this comment.
*/
case TIOCMGET:
- if ((rc = verify_area(VERIFY_WRITE, (void *) arg,
- sizeof(unsigned int))) == 0) {
+ rc = -EFAULT;
+ if (access_ok(VERIFY_WRITE, (void *) arg,
+ sizeof(unsigned int))) {
+ rc = 0;
ival = rio_getsignals(port);
put_user(ival, (unsigned int *) arg);
}
--- linux-2.6.11-rc1-bk4-orig/drivers/char/generic_nvram.c 2004-12-24 22:34:01.000000000 +0100
+++ linux-2.6.11-rc1-bk4/drivers/char/generic_nvram.c 2005-01-17 21:02:48.000000000 +0100
@@ -51,7 +51,7 @@ static ssize_t read_nvram(struct file *f
unsigned int i;
char __user *p = buf;

- if (verify_area(VERIFY_WRITE, buf, count))
+ if (!access_ok(VERIFY_WRITE, buf, count))
return -EFAULT;
if (*ppos >= NVRAM_SIZE)
return 0;
@@ -69,7 +69,7 @@ static ssize_t write_nvram(struct file *
const char __user *p = buf;
char c;

- if (verify_area(VERIFY_READ, buf, count))
+ if (!access_ok(VERIFY_READ, buf, count))
return -EFAULT;
if (*ppos >= NVRAM_SIZE)
return 0;
--- linux-2.6.11-rc1-bk4-orig/drivers/char/nwflash.c 2004-12-24 22:35:49.000000000 +0100
+++ linux-2.6.11-rc1-bk4/drivers/char/nwflash.c 2005-01-17 21:03:05.000000000 +0100
@@ -182,7 +182,7 @@ static ssize_t flash_write(struct file *
if (count > gbFlashSize - p)
count = gbFlashSize - p;

- if (verify_area(VERIFY_READ, buf, count))
+ if (!access_ok(VERIFY_READ, buf, count))
return -EFAULT;

/*
--- linux-2.6.11-rc1-bk4-orig/drivers/char/serial_tx3912.c 2004-12-24 22:34:57.000000000 +0100
+++ linux-2.6.11-rc1-bk4/drivers/char/serial_tx3912.c 2005-01-17 21:57:15.000000000 +0100
@@ -617,13 +617,15 @@ static int rs_ioctl (struct tty_struct *
}
break;
case TIOCGSERIAL:
- if ((rc = verify_area(VERIFY_WRITE, (void *) arg,
- sizeof(struct serial_struct))) == 0)
+ rc = -EFAULT;
+ if (access_ok(VERIFY_WRITE, (void *) arg,
+ sizeof(struct serial_struct)))
rc = gs_getserial(&port->gs, (struct serial_struct *) arg);
break;
case TIOCSSERIAL:
- if ((rc = verify_area(VERIFY_READ, (void *) arg,
- sizeof(struct serial_struct))) == 0)
+ rc = -EFAULT;
+ if (access_ok(VERIFY_READ, (void *) arg,
+ sizeof(struct serial_struct)))
rc = gs_setserial(&port->gs, (struct serial_struct *) arg);
break;
default:
--- linux-2.6.11-rc1-bk4-orig/drivers/char/selection.c 2005-01-12 23:26:11.000000000 +0100
+++ linux-2.6.11-rc1-bk4/drivers/char/selection.c 2005-01-17 21:57:37.000000000 +0100
@@ -122,7 +122,7 @@ int set_selection(const struct tiocl_sel

{ unsigned short xs, ys, xe, ye;

- if (verify_area(VERIFY_READ, sel, sizeof(*sel)))
+ if (!access_ok(VERIFY_READ, sel, sizeof(*sel)))
return -EFAULT;
__get_user(xs, &sel->xs);
__get_user(ys, &sel->ys);
--- linux-2.6.11-rc1-bk4-orig/drivers/char/vt_ioctl.c 2005-01-12 23:26:11.000000000 +0100
+++ linux-2.6.11-rc1-bk4/drivers/char/vt_ioctl.c 2005-01-17 22:19:44.000000000 +0100
@@ -336,15 +336,13 @@ static inline int
do_unimap_ioctl(int cmd, struct unimapdesc __user *user_ud, int perm, unsigned int console)
{
struct unimapdesc tmp;
- int i = 0;

if (copy_from_user(&tmp, user_ud, sizeof tmp))
return -EFAULT;
- if (tmp.entries) {
- i = verify_area(VERIFY_WRITE, tmp.entries,
- tmp.entry_ct*sizeof(struct unipair));
- if (i) return i;
- }
+ if (tmp.entries)
+ if (!access_ok(VERIFY_WRITE, tmp.entries,
+ tmp.entry_ct*sizeof(struct unipair)))
+ return -EFAULT;
switch (cmd) {
case PIO_UNIMAP:
if (!perm)
@@ -864,7 +862,7 @@ int vt_ioctl(struct tty_struct *tty, str
ushort ll,cc,vlin,clin,vcol,ccol;
if (!perm)
return -EPERM;
- if (verify_area(VERIFY_READ, vtconsize,
+ if (!access_ok(VERIFY_READ, vtconsize,
sizeof(struct vt_consize)))
return -EFAULT;
__get_user(ll, &vtconsize->v_rows);
--- linux-2.6.11-rc1-bk4-orig/drivers/char/n_hdlc.c 2005-01-12 23:26:11.000000000 +0100
+++ linux-2.6.11-rc1-bk4/drivers/char/n_hdlc.c 2005-01-17 22:22:08.000000000 +0100
@@ -575,7 +575,6 @@ static ssize_t n_hdlc_tty_read(struct tt
__u8 __user *buf, size_t nr)
{
struct n_hdlc *n_hdlc = tty2n_hdlc(tty);
- int error;
int ret;
struct n_hdlc_buf *rbuf;

@@ -587,11 +586,10 @@ static ssize_t n_hdlc_tty_read(struct tt
return -EIO;

/* verify user access to buffer */
- error = verify_area (VERIFY_WRITE, buf, nr);
- if (error != 0) {
- printk(KERN_WARNING"%s(%d) n_hdlc_tty_read() can't verify user "
- "buffer\n",__FILE__,__LINE__);
- return (error);
+ if (!access_ok(VERIFY_WRITE, buf, nr)) {
+ printk(KERN_WARNING "%s(%d) n_hdlc_tty_read() can't verify user "
+ "buffer\n", __FILE__, __LINE__);
+ return -EFAULT;
}

for (;;) {
--- linux-2.6.11-rc1-bk4-orig/drivers/isdn/i4l/isdn_ppp.c 2004-12-24 22:35:01.000000000 +0100
+++ linux-2.6.11-rc1-bk4/drivers/isdn/i4l/isdn_ppp.c 2005-01-17 22:24:40.000000000 +0100
@@ -764,7 +764,6 @@ isdn_ppp_read(int min, struct file *file
{
struct ippp_struct *is;
struct ippp_buf_queue *b;
- int r;
u_long flags;
u_char *save_buf;

@@ -773,8 +772,8 @@ isdn_ppp_read(int min, struct file *file
if (!(is->state & IPPP_OPEN))
return 0;

- if ((r = verify_area(VERIFY_WRITE, buf, count)))
- return r;
+ if (!access_ok(VERIFY_WRITE, buf, count))
+ return -EFAULT;

spin_lock_irqsave(&is->buflock, flags);
b = is->first->next;
@@ -1995,12 +1994,9 @@ isdn_ppp_dev_ioctl_stats(int slot, struc
struct ppp_stats __user *res = ifr->ifr_data;
struct ppp_stats t;
isdn_net_local *lp = (isdn_net_local *) dev->priv;
- int err;
-
- err = verify_area(VERIFY_WRITE, res, sizeof(struct ppp_stats));

- if (err)
- return err;
+ if (!access_ok(VERIFY_WRITE, res, sizeof(struct ppp_stats)))
+ return -EFAULT;

/* build a temporary stat struct and copy it to user space */

--- linux-2.6.11-rc1-bk4-orig/drivers/isdn/i4l/isdn_common.c 2004-12-24 22:34:31.000000000 +0100
+++ linux-2.6.11-rc1-bk4/drivers/isdn/i4l/isdn_common.c 2005-01-17 22:31:04.000000000 +0100
@@ -1180,9 +1180,9 @@ isdn_ioctl(struct inode *inode, struct f
if (arg) {
ulong __user *p = argp;
int i;
- if ((ret = verify_area(VERIFY_WRITE, p,
- sizeof(ulong) * ISDN_MAX_CHANNELS * 2)))
- return ret;
+ if (!access_ok(VERIFY_WRITE, p,
+ sizeof(ulong) * ISDN_MAX_CHANNELS * 2))
+ return -EFAULT;
for (i = 0; i < ISDN_MAX_CHANNELS; i++) {
put_user(dev->ibytes[i], p++);
put_user(dev->obytes[i], p++);
@@ -1420,10 +1420,10 @@ isdn_ioctl(struct inode *inode, struct f
char __user *p = argp;
int i;

- if ((ret = verify_area(VERIFY_WRITE, argp,
+ if (!access_ok(VERIFY_WRITE, argp,
(ISDN_MODEM_NUMREG + ISDN_MSNLEN + ISDN_LMSNLEN)
- * ISDN_MAX_CHANNELS)))
- return ret;
+ * ISDN_MAX_CHANNELS))
+ return -EFAULT;

for (i = 0; i < ISDN_MAX_CHANNELS; i++) {
if (copy_to_user(p, dev->mdm.info[i].emu.profile,
@@ -1447,10 +1447,10 @@ isdn_ioctl(struct inode *inode, struct f
char __user *p = argp;
int i;

- if ((ret = verify_area(VERIFY_READ, argp,
+ if (!access_ok(VERIFY_READ, argp,
(ISDN_MODEM_NUMREG + ISDN_MSNLEN + ISDN_LMSNLEN)
- * ISDN_MAX_CHANNELS)))
- return ret;
+ * ISDN_MAX_CHANNELS))
+ return -EFAULT;

for (i = 0; i < ISDN_MAX_CHANNELS; i++) {
if (copy_from_user(dev->mdm.info[i].emu.profile, p,
@@ -1496,8 +1496,8 @@ isdn_ioctl(struct inode *inode, struct f
int j = 0;

while (1) {
- if ((ret = verify_area(VERIFY_READ, p, 1)))
- return ret;
+ if (!access_ok(VERIFY_READ, p, 1))
+ return -EFAULT;
get_user(bname[j], p++);
switch (bname[j]) {
case '\0':
@@ -1563,9 +1563,9 @@ isdn_ioctl(struct inode *inode, struct f
drvidx = 0;
if (drvidx == -1)
return -ENODEV;
- if ((ret = verify_area(VERIFY_WRITE, argp,
- sizeof(isdn_ioctl_struct))))
- return ret;
+ if (!access_ok(VERIFY_WRITE, argp,
+ sizeof(isdn_ioctl_struct)))
+ return -EFAULT;
c.driver = drvidx;
c.command = ISDN_CMD_IOCTL;
c.arg = cmd;
--- linux-2.6.11-rc1-bk4-orig/drivers/isdn/icn/icn.c 2005-01-12 23:26:12.000000000 +0100
+++ linux-2.6.11-rc1-bk4/drivers/isdn/icn/icn.c 2005-01-17 22:33:09.000000000 +0100
@@ -908,14 +908,13 @@ icn_loadproto(u_char __user * buffer, ic
uint left = ICN_CODE_STAGE2;
uint cnt;
int timer;
- int ret;
unsigned long flags;

#ifdef BOOT_DEBUG
printk(KERN_DEBUG "icn_loadproto called\n");
#endif
- if ((ret = verify_area(VERIFY_READ, buffer, ICN_CODE_STAGE2)))
- return ret;
+ if (!access_ok(VERIFY_READ, buffer, ICN_CODE_STAGE2))
+ return -EFAULT;
timer = 0;
spin_lock_irqsave(&dev.devlock, flags);
if (card->secondhalf) {
--- linux-2.6.11-rc1-bk4-orig/drivers/isdn/isdnloop/isdnloop.c 2004-12-24 22:33:48.000000000 +0100
+++ linux-2.6.11-rc1-bk4/drivers/isdn/isdnloop/isdnloop.c 2005-01-17 22:36:08.000000000 +0100
@@ -1146,8 +1146,8 @@ isdnloop_command(isdn_ctrl * c, isdnloop
case ISDNLOOP_IOCTL_DEBUGVAR:
return (ulong) card;
case ISDNLOOP_IOCTL_STARTUP:
- if ((i = verify_area(VERIFY_READ, (void *) a, sizeof(isdnloop_sdef))))
- return i;
+ if (!access_ok(VERIFY_READ, (void *) a, sizeof(isdnloop_sdef)))
+ return -EFAULT;
return (isdnloop_start(card, (isdnloop_sdef *) a));
break;
case ISDNLOOP_IOCTL_ADDCARD:
--- linux-2.6.11-rc1-bk4-orig/drivers/isdn/act2000/act2000_isa.c 2004-12-24 22:34:32.000000000 +0100
+++ linux-2.6.11-rc1-bk4/drivers/isdn/act2000/act2000_isa.c 2005-01-17 22:37:25.000000000 +0100
@@ -401,7 +401,6 @@ int
act2000_isa_download(act2000_card * card, act2000_ddef __user * cb)
{
unsigned int length;
- int ret;
int l;
int c;
long timeout;
@@ -413,12 +412,12 @@ act2000_isa_download(act2000_card * card
if (!act2000_isa_reset(card->port))
return -ENXIO;
msleep_interruptible(500);
- if(copy_from_user(&cblock, cb, sizeof(cblock)))
+ if (copy_from_user(&cblock, cb, sizeof(cblock)))
return -EFAULT;
length = cblock.length;
p = cblock.buffer;
- if ((ret = verify_area(VERIFY_READ, p, length)))
- return ret;
+ if (!access_ok(VERIFY_READ, p, length))
+ return -EFAULT;
buf = (u_char *) kmalloc(1024, GFP_KERNEL);
if (!buf)
return -ENOMEM;
--- linux-2.6.11-rc1-bk4-orig/drivers/s390/net/ctctty.c 2004-12-24 22:34:58.000000000 +0100
+++ linux-2.6.11-rc1-bk4/drivers/s390/net/ctctty.c 2005-01-17 22:38:39.000000000 +0100
@@ -778,11 +778,10 @@ ctc_tty_ioctl(struct tty_struct *tty, st
printk(KERN_DEBUG "%s%d ioctl TIOCSERGETLSR\n", CTC_TTY_NAME,
info->line);
#endif
- error = verify_area(VERIFY_WRITE, (void __user *) arg, sizeof(uint));
- if (error)
- return error;
- else
+ if (access_ok(VERIFY_WRITE, (void __user *) arg, sizeof(uint)))
return ctc_tty_get_lsr_info(info, (uint __user *) arg);
+ else
+ return -EFAULT;
default:
#ifdef CTC_DEBUG_MODEM_IOCTL
printk(KERN_DEBUG "UNKNOWN ioctl 0x%08x on %s%d\n", cmd,
--- linux-2.6.11-rc1-bk4-orig/drivers/sbus/char/aurora.c 2004-12-24 22:34:01.000000000 +0100
+++ linux-2.6.11-rc1-bk4/drivers/sbus/char/aurora.c 2005-01-17 22:39:30.000000000 +0100
@@ -1887,14 +1887,12 @@ extern int aurora_get_serial_info(struct
{
struct serial_struct tmp;
struct Aurora_board *bp = port_Board(port);
- int error;

#ifdef AURORA_DEBUG
printk("aurora_get_serial_info: start\n");
#endif
- error = verify_area(VERIFY_WRITE, (void *) retinfo, sizeof(tmp));
- if (error)
- return error;
+ if (!access_ok(VERIFY_WRITE, (void *) retinfo, sizeof(tmp)))
+ return -EFAULT;

memset(&tmp, 0, sizeof(tmp));
tmp.type = PORT_CIRRUS;
--- linux-2.6.11-rc1-bk4-orig/drivers/sbus/char/openprom.c 2004-12-24 22:35:23.000000000 +0100
+++ linux-2.6.11-rc1-bk4/drivers/sbus/char/openprom.c 2005-01-17 22:41:33.000000000 +0100
@@ -427,16 +427,14 @@ static int openprom_bsd_ioctl(struct ino
len = op.op_buflen = 0;
}

- error = verify_area(VERIFY_WRITE, argp, sizeof(op));
- if (error) {
+ if (!access_ok(VERIFY_WRITE, argp, sizeof(op))) {
kfree(str);
- return error;
+ return -EFAULT;
}

- error = verify_area(VERIFY_WRITE, op.op_buf, len);
- if (error) {
+ if (!access_ok(VERIFY_WRITE, op.op_buf, len)) {
kfree(str);
- return error;
+ return -EFAULT;
}

error = __copy_to_user(argp, &op, sizeof(op));



-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/