cdrom: information leak in cdrom_ioctl_media_changed()

[pandora-kernel.git] / drivers / cdrom / cdrom.c

diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c
index f997c27..3792f5c 100644 (file)
--- a/drivers/cdrom/cdrom.c
+++ b/drivers/cdrom/cdrom.c
@@ -873,6 +873,7 @@ static int cdrom_is_dvd_rw(struct cdrom_device_info *cdi)
        switch (cdi->mmc3_profile) {
        case 0x12:      /* DVD-RAM      */
        case 0x1A:      /* DVD+RW       */
+       case 0x43:      /* BD-RE        */
                return 0;
        default:
                return 1;
@@ -2120,11 +2121,6 @@ static int cdrom_read_cdda_old(struct cdrom_device_info *cdi, __u8 __user *ubuf,
        if (!nr)
                return -ENOMEM;
 
-       if (!access_ok(VERIFY_WRITE, ubuf, nframes * CD_FRAMESIZE_RAW)) {
-               ret = -EFAULT;
-               goto out;
-       }
-
        cgc.data_direction = CGC_DATA_READ;
        while (nframes > 0) {
                if (nr > nframes)
@@ -2133,7 +2129,7 @@ static int cdrom_read_cdda_old(struct cdrom_device_info *cdi, __u8 __user *ubuf,
                ret = cdrom_read_block(cdi, &cgc, lba, nr, 1, CD_FRAMESIZE_RAW);
                if (ret)
                        break;
-               if (__copy_to_user(ubuf, cgc.buffer, CD_FRAMESIZE_RAW * nr)) {
+               if (copy_to_user(ubuf, cgc.buffer, CD_FRAMESIZE_RAW * nr)) {
                        ret = -EFAULT;
                        break;
                }
@@ -2141,7 +2137,6 @@ static int cdrom_read_cdda_old(struct cdrom_device_info *cdi, __u8 __user *ubuf,
                nframes -= nr;
                lba += nr;
        }
-out:
        kfree(cgc.buffer);
        return ret;
 }
@@ -2347,7 +2342,7 @@ static int cdrom_ioctl_media_changed(struct cdrom_device_info *cdi,
        if (!CDROM_CAN(CDC_SELECT_DISC) || arg == CDSL_CURRENT)
                return media_changed(cdi, 1);
 
-       if ((unsigned int)arg >= cdi->capacity)
+       if (arg >= cdi->capacity)
                return -EINVAL;
 
        info = kmalloc(sizeof(*info), GFP_KERNEL);
@@ -2747,12 +2742,11 @@ int cdrom_ioctl(struct cdrom_device_info *cdi, struct block_device *bdev,
 {
        void __user *argp = (void __user *)arg;
        int ret;
-       struct gendisk *disk = bdev->bd_disk;
 
        /*
         * Try the generic SCSI command ioctl's first.
         */
-       ret = scsi_cmd_ioctl(disk->queue, disk, mode, cmd, argp);
+       ret = scsi_cmd_blk_ioctl(bdev, mode, cmd, argp);
        if (ret != -ENOTTY)
                return ret;
 
@@ -2892,7 +2886,7 @@ static noinline int mmc_ioctl_cdrom_read_data(struct cdrom_device_info *cdi,
        if (lba < 0)
                return -EINVAL;
 
-       cgc->buffer = kmalloc(blocksize, GFP_KERNEL);
+       cgc->buffer = kzalloc(blocksize, GFP_KERNEL);
        if (cgc->buffer == NULL)
                return -ENOMEM;