On Thu, Mar 06, 2014 at 04:06:49PM +1100, Stephen Rothwell wrote:
> Hi Greg,
>
> Today's linux-next merge of the staging tree got a conflict in
> drivers/staging/cxt1e1/linux.c between commit 084b6e7765b9
> ("staging/cxt1e1/linux.c: Correct arbitrary memory write in c4_ioctl()")
> from the staging.current tree and commit 922b81b835c4 ("staging: cxt1e1:
> remove space between function name and parenthesis") and a couple of
> others from the staging tree.
>
> I fixed it up (see below) and can carry the fix as necessary (no action
> is required).
Thanks, that looks good.
greg k-h
>
> --
> Cheers,
> Stephen Rothwell sfr@xxxxxxxxxxxxxxxx
>
> diff --cc drivers/staging/cxt1e1/linux.c
> index 79206cb3fb94,579e68e3dece..000000000000
> --- a/drivers/staging/cxt1e1/linux.c
> +++ b/drivers/staging/cxt1e1/linux.c
> @@@ -861,79 -876,78 +876,80 @@@ c4_ioctl(struct net_device *ndev, struc
> #endif
>
> #if 0
> - pr_info("c4_ioctl: iocmd %x, dir %x type %x nr %x iolen %d.\n", iocmd,
> - _IOC_DIR (iocmd), _IOC_TYPE (iocmd), _IOC_NR (iocmd),
> - _IOC_SIZE (iocmd));
> + pr_info("c4_ioctl: iocmd %x, dir %x type %x nr %x iolen %d.\n", iocmd,
> + _IOC_DIR(iocmd), _IOC_TYPE(iocmd), _IOC_NR(iocmd),
> + _IOC_SIZE(iocmd));
> #endif
> - iolen = _IOC_SIZE (iocmd);
> - if (iolen > sizeof(arg))
> - return -EFAULT;
> - data = ifr->ifr_data + sizeof (iocmd);
> - if (copy_from_user (&arg, data, iolen))
> - return -EFAULT;
> -
> - ret = 0;
> - switch (iocmd)
> - {
> - case SBE_IOC_PORT_GET:
> - //pr_info(">> SBE_IOC_PORT_GET Ioctl...\n");
> - ret = do_get_port (ndev, data);
> - break;
> - case SBE_IOC_PORT_SET:
> - //pr_info(">> SBE_IOC_PORT_SET Ioctl...\n");
> - ret = do_set_port (ndev, data);
> - break;
> - case SBE_IOC_CHAN_GET:
> - //pr_info(">> SBE_IOC_CHAN_GET Ioctl...\n");
> - ret = do_get_chan (ndev, data);
> - break;
> - case SBE_IOC_CHAN_SET:
> - //pr_info(">> SBE_IOC_CHAN_SET Ioctl...\n");
> - ret = do_set_chan (ndev, data);
> - break;
> - case C4_DEL_CHAN:
> - //pr_info(">> C4_DEL_CHAN Ioctl...\n");
> - ret = do_del_chan (ndev, data);
> - break;
> - case SBE_IOC_CHAN_NEW:
> - ret = do_create_chan (ndev, data);
> - break;
> - case SBE_IOC_CHAN_GET_STAT:
> - ret = do_get_chan_stats (ndev, data);
> - break;
> - case SBE_IOC_LOGLEVEL:
> - ret = do_set_loglevel (ndev, data);
> - break;
> - case SBE_IOC_RESET_DEV:
> - ret = do_reset (ndev, data);
> - break;
> - case SBE_IOC_CHAN_DEL_STAT:
> - ret = do_reset_chan_stats (ndev, data);
> - break;
> - case C4_LOOP_PORT:
> - ret = do_port_loop (ndev, data);
> - break;
> - case C4_RW_FRMR:
> - ret = do_framer_rw (ndev, data);
> - break;
> - case C4_RW_MSYC:
> - ret = do_musycc_rw (ndev, data);
> - break;
> - case C4_RW_PLD:
> - ret = do_pld_rw (ndev, data);
> - break;
> - case SBE_IOC_IID_GET:
> - ret = (iolen == sizeof (struct sbe_iid_info)) ? c4_get_iidinfo (ci, &arg.u.iip) : -EFAULT;
> - if (ret == 0) /* no error, copy data */
> - if (copy_to_user (data, &arg, iolen))
> - return -EFAULT;
> - break;
> - default:
> - //pr_info(">> c4_ioctl: EINVAL - unknown iocmd <%x>\n", iocmd);
> - ret = -EINVAL;
> - break;
> - }
> - return mkret (ret);
> + iolen = _IOC_SIZE(iocmd);
> ++ if (iolen > sizeof(arg))
> ++ return -EFAULT;
> + data = ifr->ifr_data + sizeof(iocmd);
> + if (copy_from_user(&arg, data, iolen))
> + return -EFAULT;
> +
> + ret = 0;
> + switch (iocmd)
> + {
> + case SBE_IOC_PORT_GET:
> + //pr_info(">> SBE_IOC_PORT_GET Ioctl...\n");
> + ret = do_get_port(ndev, data);
> + break;
> + case SBE_IOC_PORT_SET:
> + //pr_info(">> SBE_IOC_PORT_SET Ioctl...\n");
> + ret = do_set_port(ndev, data);
> + break;
> + case SBE_IOC_CHAN_GET:
> + //pr_info(">> SBE_IOC_CHAN_GET Ioctl...\n");
> + ret = do_get_chan(ndev, data);
> + break;
> + case SBE_IOC_CHAN_SET:
> + //pr_info(">> SBE_IOC_CHAN_SET Ioctl...\n");
> + ret = do_set_chan(ndev, data);
> + break;
> + case C4_DEL_CHAN:
> + //pr_info(">> C4_DEL_CHAN Ioctl...\n");
> + ret = do_del_chan(ndev, data);
> + break;
> + case SBE_IOC_CHAN_NEW:
> + ret = do_create_chan(ndev, data);
> + break;
> + case SBE_IOC_CHAN_GET_STAT:
> + ret = do_get_chan_stats(ndev, data);
> + break;
> + case SBE_IOC_LOGLEVEL:
> + ret = do_set_loglevel(ndev, data);
> + break;
> + case SBE_IOC_RESET_DEV:
> + ret = do_reset(ndev, data);
> + break;
> + case SBE_IOC_CHAN_DEL_STAT:
> + ret = do_reset_chan_stats(ndev, data);
> + break;
> + case C4_LOOP_PORT:
> + ret = do_port_loop(ndev, data);
> + break;
> + case C4_RW_FRMR:
> + ret = do_framer_rw(ndev, data);
> + break;
> + case C4_RW_MSYC:
> + ret = do_musycc_rw(ndev, data);
> + break;
> + case C4_RW_PLD:
> + ret = do_pld_rw(ndev, data);
> + break;
> + case SBE_IOC_IID_GET:
> + ret = (iolen == sizeof(struct sbe_iid_info)) ?
> + c4_get_iidinfo(ci, &arg.u.iip) : -EFAULT;
> + if (ret == 0) /* no error, copy data */
> + if (copy_to_user(data, &arg, iolen))
> + return -EFAULT;
> + break;
> + default:
> + //pr_info(">> c4_ioctl: EINVAL - unknown iocmd <%x>\n", iocmd);
> + ret = -EINVAL;
> + break;
> + }
> + return mkret(ret);
> }
>
> static const struct net_device_ops c4_ops = {
--
To unsubscribe from this list: send the line "unsubscribe linux-next" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
