diff options
| author | Peter Osterlund <petero2@telia.com> | 2005-05-14 00:58:30 -0700 |
|---|---|---|
| committer | Greg KH <gregkh@suse.de> | 2005-05-16 10:45:48 -0700 |
| commit | 6d608f690e9f0d51b07400c9fdfaaa1e3302ba69 (patch) | |
| tree | fcac5f1e3f17559ddb8b02f9c969676feddb6bc0 | |
| parent | 739b21c70fae430367c7617cb88548fe783ce24f (diff) | |
[PATCH] Fix root hole in pktcdvd
ioctl_by_bdev may only be used INSIDE the kernel. If the "arg" argument
refers to memory that is accessed by put_user/get_user in the ioctl
function, the memory needs to be in the kernel address space (that's the
set_fs(KERNEL_DS) doing in the ioctl_by_bdev). This works on i386 because
even with set_fs(KERNEL_DS) the user space memory is still accessible with
put_user/get_user. That is not true for s390. In short the ioctl
implementation of the pktcdvd device driver is horribly broken.
Signed-off-by: Peter Osterlund <petero2@telia.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| -rw-r--r-- | drivers/block/pktcdvd.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/block/pktcdvd.c b/drivers/block/pktcdvd.c index 7590000b9457..043cd274c165 100644 --- a/drivers/block/pktcdvd.c +++ b/drivers/block/pktcdvd.c @@ -2400,7 +2400,7 @@ static int pkt_ioctl(struct inode *inode, struct file *file, unsigned int cmd, u case CDROM_LAST_WRITTEN: case CDROM_SEND_PACKET: case SCSI_IOCTL_SEND_COMMAND: - return ioctl_by_bdev(pd->bdev, cmd, arg); + return blkdev_ioctl(pd->bdev->bd_inode, file, cmd, arg); case CDROMEJECT: /* @@ -2408,7 +2408,7 @@ static int pkt_ioctl(struct inode *inode, struct file *file, unsigned int cmd, u * have to unlock it or else the eject command fails. */ pkt_lock_door(pd, 0); - return ioctl_by_bdev(pd->bdev, cmd, arg); + return blkdev_ioctl(pd->bdev->bd_inode, file, cmd, arg); default: printk("pktcdvd: Unknown ioctl for %s (%x)\n", pd->name, cmd); |