From a3929484af75ee524419edbbc4e9ce012c3d67c9 Mon Sep 17 00:00:00 2001 From: Al Viro Date: Sun, 10 May 2020 17:34:20 -0400 Subject: atm: move copyin from atm_getnames() into the caller Signed-off-by: Al Viro --- net/atm/ioctl.c | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) (limited to 'net/atm/ioctl.c') diff --git a/net/atm/ioctl.c b/net/atm/ioctl.c index 0b4b07740fe4..e239cebf48da 100644 --- a/net/atm/ioctl.c +++ b/net/atm/ioctl.c @@ -56,6 +56,8 @@ static int do_vcc_ioctl(struct socket *sock, unsigned int cmd, int error; struct list_head *pos; void __user *argp = (void __user *)arg; + void __user *buf; + int __user *len; vcc = ATM_SD(sock); switch (cmd) { @@ -163,7 +165,22 @@ static int do_vcc_ioctl(struct socket *sock, unsigned int cmd, goto done; if (cmd == ATM_GETNAMES) { - error = atm_getnames(argp, compat); + if (IS_ENABLED(CONFIG_COMPAT) && compat) { +#ifdef CONFIG_COMPAT + struct compat_atm_iobuf __user *ciobuf = argp; + compat_uptr_t cbuf; + len = &ciobuf->length; + if (get_user(cbuf, &ciobuf->buffer)) + return -EFAULT; + buf = compat_ptr(cbuf); +#endif + } else { + struct atm_iobuf __user *iobuf = argp; + len = &iobuf->length; + if (get_user(buf, &iobuf->buffer)) + return -EFAULT; + } + error = atm_getnames(buf, len); } else { error = atm_dev_ioctl(cmd, argp, compat); } -- cgit