The way comedi compat ioctls are done is wrong.
Instead of having ->compat_ioctl() copying the 32bit
stuff in, then passing the kernel copies to helpers shared
with native ->ioctl() and doing copyout with conversion if
needed, it's playing silly buggers with creating a 64bit
copy on user stack, then calling native ioctl (which copies
that copy into the kernel), then fetching it from user stack,
converting to 32bit variant and copying that to user.
Extra headache for no good reason. And the single
largest remaining pile of __put_user()/__get_user() this side
of arch/*. IMO compat_alloc_user_space() should die...
NOTE: this is only compile-tested - I simply don't
have the hardware in question.
Anyway, the branch lives in #uaccess.comedi, based
at v5.7-rc1
Al Viro (10):
comedi: move compat ioctl handling to native fops
comedi: get rid of indirection via translated_ioctl()
comedi: get rid of compat_alloc_user_space() mess in COMEDI_CHANINFO compat
comedi: get rid of compat_alloc_user_space() mess in COMEDI_RANGEINFO compat
comedi: get rid of compat_alloc_user_space() mess in COMEDI_INSN compat
comedi: get rid of compat_alloc_user_space() mess in COMEDI_INSNLIST compat
comedi: lift copy_from_user() into callers of __comedi_get_user_cmd()
comedi: do_cmdtest_ioctl(): lift copyin/copyout into the caller
comedi: do_cmd_ioctl(): lift copyin/copyout into the caller
comedi: get rid of compat_alloc_user_space() mess in COMEDI_CMD{,TEST} compat
drivers/staging/comedi/Makefile | 1 -
drivers/staging/comedi/comedi_compat32.c | 455 -------------------------
drivers/staging/comedi/comedi_compat32.h | 28 --
drivers/staging/comedi/comedi_fops.c | 563 +++++++++++++++++++++++++------
drivers/staging/comedi/comedi_internal.h | 2 +-
drivers/staging/comedi/range.c | 17 +-
6 files changed, 466 insertions(+), 600 deletions(-)
delete mode 100644 drivers/staging/comedi/comedi_compat32.c
delete mode 100644 drivers/staging/comedi/comedi_compat32.h
