fbdev: Fixing arbitrary kernel leak in case FBIOGETCMAP_SPARC in sbusfb_ioctl_helper().

[pandora-kernel.git] / drivers / video / sbuslib.c

diff --git a/drivers/video/sbuslib.c b/drivers/video/sbuslib.c
index 963a454..51c0df1 100644 (file)
--- a/drivers/video/sbuslib.c
+++ b/drivers/video/sbuslib.c
@@ -9,18 +9,20 @@
 #include <linux/string.h>
 #include <linux/fb.h>
 #include <linux/mm.h>
+#include <linux/uaccess.h>
+#include <linux/of_device.h>
 
-#include <asm/oplib.h>
 #include <asm/fbio.h>
 
 #include "sbuslib.h"
 
-void sbusfb_fill_var(struct fb_var_screeninfo *var, int prom_node, int bpp)
+void sbusfb_fill_var(struct fb_var_screeninfo *var, struct device_node *dp,
+                    int bpp)
 {
        memset(var, 0, sizeof(*var));
 
-       var->xres = prom_getintdefault(prom_node, "width", 1152);
-       var->yres = prom_getintdefault(prom_node, "height", 900);
+       var->xres = of_getintprop_default(dp, "width", 1152);
+       var->yres = of_getintprop_default(dp, "height", 900);
        var->xres_virtual = var->xres;
        var->yres_virtual = var->yres;
        var->bits_per_pixel = bpp;
@@ -120,7 +122,7 @@ int sbusfb_ioctl_helper(unsigned long cmd, unsigned long arg,
                unsigned char __user *ured;
                unsigned char __user *ugreen;
                unsigned char __user *ublue;
-               int index, count, i;
+               unsigned int index, count, i;
 
                if (get_user(index, &c->index) ||
                    __get_user(count, &c->count) ||
@@ -159,7 +161,7 @@ int sbusfb_ioctl_helper(unsigned long cmd, unsigned long arg,
                unsigned char __user *ugreen;
                unsigned char __user *ublue;
                struct fb_cmap *cmap = &info->cmap;
-               int index, count, i;
+               unsigned int index, count, i;
                u8 red, green, blue;
 
                if (get_user(index, &c->index) ||