3.13.11-ckt33 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------ From: Al Viro <[email protected]> commit 9225c0b7b976dd9ceac2b80727a60d8fcb906a62 upstream. missing get_user() Signed-off-by: Al Viro <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]> [ luis: backported to 3.16: adjusted context ] Signed-off-by: Luis Henriques <[email protected]> Signed-off-by: Kamal Mostafa <[email protected]> --- drivers/staging/lustre/lustre/obdecho/echo_client.c | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) diff --git a/drivers/staging/lustre/lustre/obdecho/echo_client.c b/drivers/staging/lustre/lustre/obdecho/echo_client.c index 1fb0ac4..b5ba46c 100644 --- a/drivers/staging/lustre/lustre/obdecho/echo_client.c +++ b/drivers/staging/lustre/lustre/obdecho/echo_client.c @@ -1381,6 +1381,7 @@ static int echo_copyout_lsm (struct lov_stripe_md *lsm, void *_ulsm, int ulsm_nob) { struct lov_stripe_md *ulsm = _ulsm; + struct lov_oinfo **p; int nob, i; nob = offsetof (struct lov_stripe_md, lsm_oinfo[lsm->lsm_stripe_count]); @@ -1390,9 +1391,10 @@ echo_copyout_lsm (struct lov_stripe_md *lsm, void *_ulsm, int ulsm_nob) if (copy_to_user (ulsm, lsm, sizeof(*ulsm))) return (-EFAULT); - for (i = 0; i < lsm->lsm_stripe_count; i++) { - if (copy_to_user (ulsm->lsm_oinfo[i], lsm->lsm_oinfo[i], - sizeof(lsm->lsm_oinfo[0]))) + for (i = 0, p = lsm->lsm_oinfo; i < lsm->lsm_stripe_count; i++, p++) { + struct lov_oinfo __user *up; + if (get_user(up, ulsm->lsm_oinfo + i) || + copy_to_user(up, *p, sizeof(struct lov_oinfo))) return (-EFAULT); } return 0; @@ -1400,9 +1402,10 @@ echo_copyout_lsm (struct lov_stripe_md *lsm, void *_ulsm, int ulsm_nob) static int echo_copyin_lsm (struct echo_device *ed, struct lov_stripe_md *lsm, - void *ulsm, int ulsm_nob) + struct lov_stripe_md __user *ulsm, int ulsm_nob) { struct echo_client_obd *ec = ed->ed_ec; + struct lov_oinfo **p; int i; if (ulsm_nob < sizeof (*lsm)) @@ -1418,11 +1421,10 @@ echo_copyin_lsm (struct echo_device *ed, struct lov_stripe_md *lsm, return (-EINVAL); - for (i = 0; i < lsm->lsm_stripe_count; i++) { - if (copy_from_user(lsm->lsm_oinfo[i], - ((struct lov_stripe_md *)ulsm)-> \ - lsm_oinfo[i], - sizeof(lsm->lsm_oinfo[0]))) + for (i = 0, p = lsm->lsm_oinfo; i < lsm->lsm_stripe_count; i++, p++) { + struct lov_oinfo __user *up; + if (get_user(up, ulsm->lsm_oinfo + i) || + copy_from_user(*p, up, sizeof(struct lov_oinfo))) return (-EFAULT); } return (0); -- 1.9.1
