git.openpandora.org
/
pandora-kernel.git
/ blobdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
|
commitdiff
|
tree
raw
|
inline
| side by side
cdrom: information leak in cdrom_ioctl_media_changed()
[pandora-kernel.git]
/
drivers
/
cdrom
/
cdrom.c
diff --git
a/drivers/cdrom/cdrom.c
b/drivers/cdrom/cdrom.c
index
f997c27
..
3792f5c
100644
(file)
--- a/
drivers/cdrom/cdrom.c
+++ b/
drivers/cdrom/cdrom.c
@@
-873,6
+873,7
@@
static int cdrom_is_dvd_rw(struct cdrom_device_info *cdi)
switch (cdi->mmc3_profile) {
case 0x12: /* DVD-RAM */
case 0x1A: /* DVD+RW */
switch (cdi->mmc3_profile) {
case 0x12: /* DVD-RAM */
case 0x1A: /* DVD+RW */
+ case 0x43: /* BD-RE */
return 0;
default:
return 1;
return 0;
default:
return 1;
@@
-2120,11
+2121,6
@@
static int cdrom_read_cdda_old(struct cdrom_device_info *cdi, __u8 __user *ubuf,
if (!nr)
return -ENOMEM;
if (!nr)
return -ENOMEM;
- if (!access_ok(VERIFY_WRITE, ubuf, nframes * CD_FRAMESIZE_RAW)) {
- ret = -EFAULT;
- goto out;
- }
-
cgc.data_direction = CGC_DATA_READ;
while (nframes > 0) {
if (nr > nframes)
cgc.data_direction = CGC_DATA_READ;
while (nframes > 0) {
if (nr > nframes)
@@
-2133,7
+2129,7
@@
static int cdrom_read_cdda_old(struct cdrom_device_info *cdi, __u8 __user *ubuf,
ret = cdrom_read_block(cdi, &cgc, lba, nr, 1, CD_FRAMESIZE_RAW);
if (ret)
break;
ret = cdrom_read_block(cdi, &cgc, lba, nr, 1, CD_FRAMESIZE_RAW);
if (ret)
break;
- if (
__
copy_to_user(ubuf, cgc.buffer, CD_FRAMESIZE_RAW * nr)) {
+ if (copy_to_user(ubuf, cgc.buffer, CD_FRAMESIZE_RAW * nr)) {
ret = -EFAULT;
break;
}
ret = -EFAULT;
break;
}
@@
-2141,7
+2137,6
@@
static int cdrom_read_cdda_old(struct cdrom_device_info *cdi, __u8 __user *ubuf,
nframes -= nr;
lba += nr;
}
nframes -= nr;
lba += nr;
}
-out:
kfree(cgc.buffer);
return ret;
}
kfree(cgc.buffer);
return ret;
}
@@
-2347,7
+2342,7
@@
static int cdrom_ioctl_media_changed(struct cdrom_device_info *cdi,
if (!CDROM_CAN(CDC_SELECT_DISC) || arg == CDSL_CURRENT)
return media_changed(cdi, 1);
if (!CDROM_CAN(CDC_SELECT_DISC) || arg == CDSL_CURRENT)
return media_changed(cdi, 1);
- if (
(unsigned int)
arg >= cdi->capacity)
+ if (arg >= cdi->capacity)
return -EINVAL;
info = kmalloc(sizeof(*info), GFP_KERNEL);
return -EINVAL;
info = kmalloc(sizeof(*info), GFP_KERNEL);
@@
-2747,12
+2742,11
@@
int cdrom_ioctl(struct cdrom_device_info *cdi, struct block_device *bdev,
{
void __user *argp = (void __user *)arg;
int ret;
{
void __user *argp = (void __user *)arg;
int ret;
- struct gendisk *disk = bdev->bd_disk;
/*
* Try the generic SCSI command ioctl's first.
*/
/*
* Try the generic SCSI command ioctl's first.
*/
- ret = scsi_cmd_
ioctl(disk->queue, disk
, mode, cmd, argp);
+ ret = scsi_cmd_
blk_ioctl(bdev
, mode, cmd, argp);
if (ret != -ENOTTY)
return ret;
if (ret != -ENOTTY)
return ret;
@@
-2892,7
+2886,7
@@
static noinline int mmc_ioctl_cdrom_read_data(struct cdrom_device_info *cdi,
if (lba < 0)
return -EINVAL;
if (lba < 0)
return -EINVAL;
- cgc->buffer = k
m
alloc(blocksize, GFP_KERNEL);
+ cgc->buffer = k
z
alloc(blocksize, GFP_KERNEL);
if (cgc->buffer == NULL)
return -ENOMEM;
if (cgc->buffer == NULL)
return -ENOMEM;