patch-2.1.44 linux/drivers/sbus/char/suncons.c

• Lines: 93
• Date: Thu Jun 26 12:33:39 1997
• Orig file: v2.1.43/linux/drivers/sbus/char/suncons.c
• Orig date: Mon Jun 16 16:35:56 1997

diff -u --recursive --new-file v2.1.43/linux/drivers/sbus/char/suncons.c linux/drivers/sbus/char/suncons.c
@@ -1,4 +1,4 @@
-/* $Id: suncons.c,v 1.63 1997/05/31 18:33:25 mj Exp $
+/* $Id: suncons.c,v 1.64 1997/06/06 10:56:25 jj Exp $
  *
  * suncons.c: Sun SparcStation console support.
  *
@@ -759,7 +759,7 @@
 	        (*fb_restore_palette) (&fbinfo[0]);
 }
 
-unsigned int
+unsigned long
 get_phys (unsigned long addr)
 {
 	return __get_phys(addr);
@@ -1641,51 +1641,55 @@
 int
 sun_hw_scursor (struct fbcursor *cursor, fbinfo_t *fb)
 {
-	int op = cursor->set;
+	int op;
 	int i, bytes = 0;
+	struct fbcursor f;
+	char red[2], green[2], blue[2];
 	
+	if (copy_from_user (&f, cursor, sizeof(struct fbcursor)))
+		return -EFAULT;
+	op = f.set;
 	if (op & FB_CUR_SETSHAPE){
-		if ((uint) cursor->size.fbx > fb->cursor.hwsize.fbx)
+		if ((uint) f.size.fbx > fb->cursor.hwsize.fbx)
 			return -EINVAL;
-		if ((uint) cursor->size.fby > fb->cursor.hwsize.fby)
+		if ((uint) f.size.fby > fb->cursor.hwsize.fby)
 			return -EINVAL;
-		bytes = (cursor->size.fby * 32)/8;
-		i = verify_area (VERIFY_READ, cursor->image, bytes);
+		bytes = (f.size.fby * 32)/8;
+		i = verify_area (VERIFY_READ, f.image, bytes);
 		if (i) return i;
-		i = verify_area (VERIFY_READ, cursor->mask, bytes);
+		i = verify_area (VERIFY_READ, f.mask, bytes);
 		if (i) return i;
 	}
 	if (op & FB_CUR_SETCMAP){
-		if (cursor->cmap.index && cursor->cmap.count != 2)
+		if (f.cmap.index || f.cmap.count != 2)
 			return -EINVAL;
-		i = verify_area (VERIFY_READ, cursor->cmap.red, 2);
-		if (i) return i;
-		i = verify_area (VERIFY_READ, cursor->cmap.green, 2);
-		if (i) return i;
-		i = verify_area (VERIFY_READ, cursor->cmap.blue, 2);
-		if (i) return i;
+		if (copy_from_user (red, f.cmap.red, 2) ||
+		    copy_from_user (green, f.cmap.green, 2) ||
+		    copy_from_user (blue, f.cmap.blue, 2))
+			return -EFAULT;
 	}
 	if (op & (FB_CUR_SETCUR | FB_CUR_SETPOS | FB_CUR_SETHOT)){
 		if (op & FB_CUR_SETCUR)
-			fb->cursor.enable = cursor->enable;
+			fb->cursor.enable = f.enable;
 		if (op & FB_CUR_SETPOS)
-			fb->cursor.cpos = cursor->pos;
+			fb->cursor.cpos = f.pos;
 		if (op & FB_CUR_SETHOT)
-			fb->cursor.chot = cursor->hot;
+			fb->cursor.chot = f.hot;
 		(*fb->setcursor) (fb);
 	}
 	if (op & FB_CUR_SETCMAP)
-		(*fb->setcursormap) (fb, cursor->cmap.red, cursor->cmap.green, cursor->cmap.blue);
+		(*fb->setcursormap) (fb, red, green, blue);
 	if (op & FB_CUR_SETSHAPE){
 		uint u;
 		
-		fb->cursor.size = cursor->size;
+		fb->cursor.size = f.size;
 		memset ((void *)&fb->cursor.bits, 0, sizeof (fb->cursor.bits));
-		memcpy (fb->cursor.bits [0], cursor->mask, bytes);
-		memcpy (fb->cursor.bits [1], cursor->image, bytes);
+		if (copy_from_user (fb->cursor.bits [0], f.mask, bytes) ||
+		    copy_from_user (fb->cursor.bits [1], f.image, bytes))
+			return -EFAULT;
 		u = ~0;
-		if (cursor->size.fbx < fb->cursor.hwsize.fbx)
-			u = ~(u  >> cursor->size.fbx);
+		if (f.size.fbx < fb->cursor.hwsize.fbx)
+			u = ~(u  >> f.size.fbx);
 		for (i = fb->cursor.size.fby - 1; i >= 0; i--) {
 			fb->cursor.bits [0][i] &= u;
 			fb->cursor.bits [1][i] &= fb->cursor.bits [0][i];