ich777/linux_media
1
0
Fork 0
mirror of https://github.com/tbsdtv/linux_media.git synced 2025-07-22 12:21:00 +02:00
Code Issues Packages Projects Releases Wiki Activity

Revert "media: drivers/media/dvb-core: copy user arrays safely"

Browse Source 
This reverts commit 04e8cbcdad.
This commit is contained in:
CrazyCat
2025-03-19 21:05:59 +02:00
parent 16ba295214
commit 2945bc07ee
1 changed files with 4 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
drivers/media/dvb-core/dvb_frontend.c
View File

@@ -2163,8 +2163,7 @@ static int dvb_frontend_handle_compat_ioctl(struct file *file, unsigned int cmd,
if (!tvps->num || (tvps->num > DTV_IOCTL_MAX_MSGS))
return -EINVAL;
tvp = memdup_array_user(compat_ptr(tvps->props),
tvps->num, sizeof(*tvp));
tvp = memdup_user(compat_ptr(tvps->props), tvps->num * sizeof(*tvp));
if (IS_ERR(tvp))
return PTR_ERR(tvp);
@@ -2195,8 +2194,7 @@ static int dvb_frontend_handle_compat_ioctl(struct file *file, unsigned int cmd,
if (!tvps->num || (tvps->num > DTV_IOCTL_MAX_MSGS))
return -EINVAL;
tvp = memdup_array_user(compat_ptr(tvps->props),
tvps->num, sizeof(*tvp));
tvp = memdup_user(compat_ptr(tvps->props), tvps->num * sizeof(*tvp));
if (IS_ERR(tvp))
return PTR_ERR(tvp);
@@ -2376,8 +2374,7 @@ static int dvb_get_property(struct dvb_frontend *fe, struct file *file,
if (!tvps->num || tvps->num > DTV_IOCTL_MAX_MSGS)
return -EINVAL;
tvp = memdup_array_user((void __user *)tvps->props,
tvps->num, sizeof(*tvp));
tvp = memdup_user((void __user *)tvps->props, tvps->num * sizeof(*tvp));
if (IS_ERR(tvp))
return PTR_ERR(tvp);
@@ -2455,8 +2452,7 @@ static int dvb_frontend_handle_ioctl(struct file *file,
if (!tvps->num || (tvps->num > DTV_IOCTL_MAX_MSGS))
return -EINVAL;
tvp = memdup_array_user((void __user *)tvps->props,
tvps->num, sizeof(*tvp));
tvp = memdup_user((void __user *)tvps->props, tvps->num * sizeof(*tvp));
if (IS_ERR(tvp))
return PTR_ERR(tvp);