2023-11-02 19:25:53

by Philipp Stanner

Subject: [PATCH] drivers/video/fbdev: use new array-copying-wrapper

viafbdev.c utilizes memdup_user() to copy an array from userspace.

There is a new wrapper, specifically designed for copying arrays. Use
this one instead.

Suggested-by: Dave Airlie <[email protected]>
Signed-off-by: Philipp Stanner <[email protected]>
---
drivers/video/fbdev/via/viafbdev.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/video/fbdev/via/viafbdev.c b/drivers/video/fbdev/via/viafbdev.c
index 58868f8880d6..a52b1ba43a48 100644
--- a/drivers/video/fbdev/via/viafbdev.c
+++ b/drivers/video/fbdev/via/viafbdev.c
@@ -574,7 +574,7 @@ static int viafb_ioctl(struct fb_info *info, u_int cmd, u_long arg)
break;

case VIAFB_SET_GAMMA_LUT:
- viafb_gamma_table = memdup_user(argp, 256 * sizeof(u32));
+ viafb_gamma_table = memdup_array_user(argp, 256, sizeof(u32));
if (IS_ERR(viafb_gamma_table))
return PTR_ERR(viafb_gamma_table);
viafb_set_gamma_table(viafb_bpp, viafb_gamma_table);
--
2.41.0

2023-11-05 18:18:11

by Helge Deller

Subject: Re: [PATCH] drivers/video/fbdev: use new array-copying-wrapper

On 11/2/23 20:24, Philipp Stanner wrote:
> viafbdev.c utilizes memdup_user() to copy an array from userspace.
>
> There is a new wrapper, specifically designed for copying arrays. Use
> this one instead.
>
> Suggested-by: Dave Airlie <[email protected]>
> Signed-off-by: Philipp Stanner <[email protected]>

applied.

Thanks!
Helge


> ---
> drivers/video/fbdev/via/viafbdev.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/video/fbdev/via/viafbdev.c b/drivers/video/fbdev/via/viafbdev.c
> index 58868f8880d6..a52b1ba43a48 100644
> --- a/drivers/video/fbdev/via/viafbdev.c
> +++ b/drivers/video/fbdev/via/viafbdev.c
> @@ -574,7 +574,7 @@ static int viafb_ioctl(struct fb_info *info, u_int cmd, u_long arg)
> break;
>
> case VIAFB_SET_GAMMA_LUT:
> - viafb_gamma_table = memdup_user(argp, 256 * sizeof(u32));
> + viafb_gamma_table = memdup_array_user(argp, 256, sizeof(u32));
> if (IS_ERR(viafb_gamma_table))
> return PTR_ERR(viafb_gamma_table);
> viafb_set_gamma_table(viafb_bpp, viafb_gamma_table);