From 2945bc07eec20b52d6cc20b290854f817c2e64bd Mon Sep 17 00:00:00 2001 From: CrazyCat Date: Wed, 19 Mar 2025 21:05:59 +0200 Subject: [PATCH] Revert "media: drivers/media/dvb-core: copy user arrays safely" This reverts commit 04e8cbcdad0db073cefbcbb27d967b336ba56fbc. --- drivers/media/dvb-core/dvb_frontend.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) diff --git a/drivers/media/dvb-core/dvb_frontend.c b/drivers/media/dvb-core/dvb_frontend.c index a05aa271a1ba..9894ac0927cd 100644 --- a/drivers/media/dvb-core/dvb_frontend.c +++ b/drivers/media/dvb-core/dvb_frontend.c @@ -2163,8 +2163,7 @@ static int dvb_frontend_handle_compat_ioctl(struct file *file, unsigned int cmd, if (!tvps->num || (tvps->num > DTV_IOCTL_MAX_MSGS)) return -EINVAL; - tvp = memdup_array_user(compat_ptr(tvps->props), - tvps->num, sizeof(*tvp)); + tvp = memdup_user(compat_ptr(tvps->props), tvps->num * sizeof(*tvp)); if (IS_ERR(tvp)) return PTR_ERR(tvp); @@ -2195,8 +2194,7 @@ static int dvb_frontend_handle_compat_ioctl(struct file *file, unsigned int cmd, if (!tvps->num || (tvps->num > DTV_IOCTL_MAX_MSGS)) return -EINVAL; - tvp = memdup_array_user(compat_ptr(tvps->props), - tvps->num, sizeof(*tvp)); + tvp = memdup_user(compat_ptr(tvps->props), tvps->num * sizeof(*tvp)); if (IS_ERR(tvp)) return PTR_ERR(tvp); @@ -2376,8 +2374,7 @@ static int dvb_get_property(struct dvb_frontend *fe, struct file *file, if (!tvps->num || tvps->num > DTV_IOCTL_MAX_MSGS) return -EINVAL; - tvp = memdup_array_user((void __user *)tvps->props, - tvps->num, sizeof(*tvp)); + tvp = memdup_user((void __user *)tvps->props, tvps->num * sizeof(*tvp)); if (IS_ERR(tvp)) return PTR_ERR(tvp); @@ -2455,8 +2452,7 @@ static int dvb_frontend_handle_ioctl(struct file *file, if (!tvps->num || (tvps->num > DTV_IOCTL_MAX_MSGS)) return -EINVAL; - tvp = memdup_array_user((void __user *)tvps->props, - tvps->num, sizeof(*tvp)); + tvp = memdup_user((void __user *)tvps->props, tvps->num * sizeof(*tvp)); if (IS_ERR(tvp)) return PTR_ERR(tvp);