@@ -537,7 +537,7 @@ static int create_elf_fdpic_tables(struct linux_binprm *bprm,
537537 platform_len = strlen (k_platform ) + 1 ;
538538 sp -= platform_len ;
539539 u_platform = (char __user * ) sp ;
540- if (__copy_to_user (u_platform , k_platform , platform_len ) != 0 )
540+ if (copy_to_user (u_platform , k_platform , platform_len ) != 0 )
541541 return - EFAULT ;
542542 }
543543
@@ -552,7 +552,7 @@ static int create_elf_fdpic_tables(struct linux_binprm *bprm,
552552 platform_len = strlen (k_base_platform ) + 1 ;
553553 sp -= platform_len ;
554554 u_base_platform = (char __user * ) sp ;
555- if (__copy_to_user (u_base_platform , k_base_platform , platform_len ) != 0 )
555+ if (copy_to_user (u_base_platform , k_base_platform , platform_len ) != 0 )
556556 return - EFAULT ;
557557 }
558558
@@ -604,11 +604,13 @@ static int create_elf_fdpic_tables(struct linux_binprm *bprm,
604604 /* put the ELF interpreter info on the stack */
605605#define NEW_AUX_ENT (id , val ) \
606606 do { \
607- struct { unsigned long _id, _val; } __user *ent; \
607+ struct { unsigned long _id, _val; } __user *ent, v ; \
608608 \
609609 ent = (void __user *) csp; \
610- __put_user((id), &ent[nr]._id); \
611- __put_user((val), &ent[nr]._val); \
610+ v._id = (id); \
611+ v._val = (val); \
612+ if (copy_to_user(ent + nr, &v, sizeof(v))) \
613+ return -EFAULT; \
612614 nr++; \
613615 } while (0)
614616
@@ -675,7 +677,8 @@ static int create_elf_fdpic_tables(struct linux_binprm *bprm,
675677
676678 /* stack argc */
677679 csp -= sizeof (unsigned long );
678- __put_user (bprm -> argc , (unsigned long __user * ) csp );
680+ if (put_user (bprm -> argc , (unsigned long __user * ) csp ))
681+ return - EFAULT ;
679682
680683 BUG_ON (csp != sp );
681684
@@ -689,25 +692,29 @@ static int create_elf_fdpic_tables(struct linux_binprm *bprm,
689692
690693 p = (char __user * ) current -> mm -> arg_start ;
691694 for (loop = bprm -> argc ; loop > 0 ; loop -- ) {
692- __put_user ((elf_caddr_t ) p , argv ++ );
695+ if (put_user ((elf_caddr_t ) p , argv ++ ))
696+ return - EFAULT ;
693697 len = strnlen_user (p , MAX_ARG_STRLEN );
694698 if (!len || len > MAX_ARG_STRLEN )
695699 return - EINVAL ;
696700 p += len ;
697701 }
698- __put_user (NULL , argv );
702+ if (put_user (NULL , argv ))
703+ return - EFAULT ;
699704 current -> mm -> arg_end = (unsigned long ) p ;
700705
701706 /* fill in the envv[] array */
702707 current -> mm -> env_start = (unsigned long ) p ;
703708 for (loop = bprm -> envc ; loop > 0 ; loop -- ) {
704- __put_user ((elf_caddr_t )(unsigned long ) p , envp ++ );
709+ if (put_user ((elf_caddr_t )(unsigned long ) p , envp ++ ))
710+ return - EFAULT ;
705711 len = strnlen_user (p , MAX_ARG_STRLEN );
706712 if (!len || len > MAX_ARG_STRLEN )
707713 return - EINVAL ;
708714 p += len ;
709715 }
710- __put_user (NULL , envp );
716+ if (put_user (NULL , envp ))
717+ return - EFAULT ;
711718 current -> mm -> env_end = (unsigned long ) p ;
712719
713720 mm -> start_stack = (unsigned long ) sp ;
@@ -849,8 +856,8 @@ static int elf_fdpic_map_file(struct elf_fdpic_params *params,
849856
850857 tmp = phdr -> p_memsz / sizeof (Elf32_Dyn );
851858 dyn = (Elf32_Dyn __user * )params -> dynamic_addr ;
852- __get_user ( d_tag , & dyn [tmp - 1 ].d_tag );
853- if ( d_tag != 0 )
859+ if ( get_user ( d_tag , & dyn [tmp - 1 ].d_tag ) ||
860+ d_tag != 0 )
854861 goto dynamic_error ;
855862 break ;
856863 }
0 commit comments