Skip to content

Commit

Permalink
ieee1394: raw1394: Fix write() for 32bit userland on 64bit kernel
Browse files Browse the repository at this point in the history 
* write(fd, buf, 52) from 32bit app was returning 56.  Most of callers did not
  care, but some (arm registration) did, and anyway it looks bad if request for
  writing 52 bytes returns 56.  And returning sizeof anything in 'int' is not
  good as well.  So all functions now return '0' instead of
  sizeof(struct raw1394_request) on success, and write() itself provides correct
  return value (it just returns value it was asked to write on success as raw1394
  does not do any partial writes at all).

* Related to this was problem that write() could have returned 0 when kernel
  state would become corrupted and moved to different state than
  opened/initialized/connected.  Now it returns -EBADFD which seemed appropriate.

Signed-off-by: Petr Vandrovec <petr@vandrovec.name>
Acked-by: Dan Dennedy <dan@dennedy.org>
Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de> (split into 3 patches)
  • Loading branch information
Petr Vandrovec authored and Stefan Richter committed Jul 9, 2007
1 parent ee9be42 commit 883b97e
Showing 1 changed file with 34 additions and 31 deletions.
65 changes: 34 additions & 31 deletions drivers/ieee1394/raw1394.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -587,7 +587,7 @@ static int state_opened(struct file_info *fi, struct pending_request *req)

req->req.length = 0;
queue_complete_req(req);
return sizeof(struct raw1394_request);
return 0;
}

static int state_initialized(struct file_info *fi, struct pending_request *req)
Expand All @@ -601,7 +601,7 @@ static int state_initialized(struct file_info *fi, struct pending_request *req)
req->req.generation = atomic_read(&internal_generation);
req->req.length = 0;
queue_complete_req(req);
return sizeof(struct raw1394_request);
return 0;
}

switch (req->req.type) {
Expand Down Expand Up @@ -673,7 +673,7 @@ static int state_initialized(struct file_info *fi, struct pending_request *req)
}

queue_complete_req(req);
return sizeof(struct raw1394_request);
return 0;
}

static void handle_iso_listen(struct file_info *fi, struct pending_request *req)
Expand Down Expand Up @@ -865,7 +865,7 @@ static int handle_async_request(struct file_info *fi,
if (req->req.error) {
req->req.length = 0;
queue_complete_req(req);
return sizeof(struct raw1394_request);
return 0;
}

hpsb_set_packet_complete_task(packet,
Expand All @@ -883,7 +883,7 @@ static int handle_async_request(struct file_info *fi,
hpsb_free_tlabel(packet);
queue_complete_req(req);
}
return sizeof(struct raw1394_request);
return 0;
}

static int handle_iso_send(struct file_info *fi, struct pending_request *req,
Expand All @@ -907,7 +907,7 @@ static int handle_iso_send(struct file_info *fi, struct pending_request *req,
req->req.error = RAW1394_ERROR_MEMFAULT;
req->req.length = 0;
queue_complete_req(req);
return sizeof(struct raw1394_request);
return 0;
}

req->req.length = 0;
Expand All @@ -927,7 +927,7 @@ static int handle_iso_send(struct file_info *fi, struct pending_request *req,
queue_complete_req(req);
}

return sizeof(struct raw1394_request);
return 0;
}

static int handle_async_send(struct file_info *fi, struct pending_request *req)
Expand All @@ -943,7 +943,7 @@ static int handle_async_send(struct file_info *fi, struct pending_request *req)
req->req.error = RAW1394_ERROR_INVALID_ARG;
req->req.length = 0;
queue_complete_req(req);
return sizeof(struct raw1394_request);
return 0;
}

data_size = req->req.length - header_length;
Expand All @@ -957,7 +957,7 @@ static int handle_async_send(struct file_info *fi, struct pending_request *req)
req->req.error = RAW1394_ERROR_MEMFAULT;
req->req.length = 0;
queue_complete_req(req);
return sizeof(struct raw1394_request);
return 0;
}

if (copy_from_user
Expand All @@ -966,7 +966,7 @@ static int handle_async_send(struct file_info *fi, struct pending_request *req)
req->req.error = RAW1394_ERROR_MEMFAULT;
req->req.length = 0;
queue_complete_req(req);
return sizeof(struct raw1394_request);
return 0;
}

packet->type = hpsb_async;
Expand Down Expand Up @@ -994,7 +994,7 @@ static int handle_async_send(struct file_info *fi, struct pending_request *req)
queue_complete_req(req);
}

return sizeof(struct raw1394_request);
return 0;
}

static int arm_read(struct hpsb_host *host, int nodeid, quadlet_t * buffer,
Expand Down Expand Up @@ -1869,7 +1869,7 @@ static int arm_register(struct file_info *fi, struct pending_request *req)
spin_lock_irqsave(&host_info_lock, flags);
list_add_tail(&addr->addr_list, &fi->addr_list);
spin_unlock_irqrestore(&host_info_lock, flags);
return sizeof(struct raw1394_request);
return 0;
}
retval =
hpsb_register_addrspace(&raw1394_highlevel, fi->host, &arm_ops,
Expand All @@ -1887,7 +1887,7 @@ static int arm_register(struct file_info *fi, struct pending_request *req)
return (-EALREADY);
}
free_pending_request(req); /* immediate success or fail */
return sizeof(struct raw1394_request);
return 0;
}

static int arm_unregister(struct file_info *fi, struct pending_request *req)
Expand Down Expand Up @@ -1955,7 +1955,7 @@ static int arm_unregister(struct file_info *fi, struct pending_request *req)
vfree(addr->addr_space_buffer);
kfree(addr);
free_pending_request(req); /* immediate success or fail */
return sizeof(struct raw1394_request);
return 0;
}
retval =
hpsb_unregister_addrspace(&raw1394_highlevel, fi->host,
Expand All @@ -1971,7 +1971,7 @@ static int arm_unregister(struct file_info *fi, struct pending_request *req)
vfree(addr->addr_space_buffer);
kfree(addr);
free_pending_request(req); /* immediate success or fail */
return sizeof(struct raw1394_request);
return 0;
}

/* Copy data from ARM buffer(s) to user buffer. */
Expand Down Expand Up @@ -2013,7 +2013,7 @@ static int arm_get_buf(struct file_info *fi, struct pending_request *req)
* queue no response, and therefore nobody
* will free it. */
free_pending_request(req);
return sizeof(struct raw1394_request);
return 0;
} else {
DBGMSG("arm_get_buf request exceeded mapping");
spin_unlock_irqrestore(&host_info_lock, flags);
Expand Down Expand Up @@ -2065,7 +2065,7 @@ static int arm_set_buf(struct file_info *fi, struct pending_request *req)
* queue no response, and therefore nobody
* will free it. */
free_pending_request(req);
return sizeof(struct raw1394_request);
return 0;
} else {
DBGMSG("arm_set_buf request exceeded mapping");
spin_unlock_irqrestore(&host_info_lock, flags);
Expand All @@ -2086,7 +2086,7 @@ static int reset_notification(struct file_info *fi, struct pending_request *req)
(req->req.misc == RAW1394_NOTIFY_ON)) {
fi->notification = (u8) req->req.misc;
free_pending_request(req); /* we have to free the request, because we queue no response, and therefore nobody will free it */
return sizeof(struct raw1394_request);
return 0;
}
/* error EINVAL (22) invalid argument */
return (-EINVAL);
Expand Down Expand Up @@ -2119,12 +2119,12 @@ static int write_phypacket(struct file_info *fi, struct pending_request *req)
req->req.length = 0;
queue_complete_req(req);
}
return sizeof(struct raw1394_request);
return 0;
}

static int get_config_rom(struct file_info *fi, struct pending_request *req)
{
int ret = sizeof(struct raw1394_request);
int ret = 0;
quadlet_t *data = kmalloc(req->req.length, GFP_KERNEL);
int status;

Expand Down Expand Up @@ -2154,7 +2154,7 @@ static int get_config_rom(struct file_info *fi, struct pending_request *req)

static int update_config_rom(struct file_info *fi, struct pending_request *req)
{
int ret = sizeof(struct raw1394_request);
int ret = 0;
quadlet_t *data = kmalloc(req->req.length, GFP_KERNEL);
if (!data)
return -ENOMEM;
Expand Down Expand Up @@ -2221,7 +2221,7 @@ static int modify_config_rom(struct file_info *fi, struct pending_request *req)

hpsb_update_config_rom_image(fi->host);
free_pending_request(req);
return sizeof(struct raw1394_request);
return 0;
}
}

Expand Down Expand Up @@ -2286,7 +2286,7 @@ static int modify_config_rom(struct file_info *fi, struct pending_request *req)
/* we have to free the request, because we queue no response,
* and therefore nobody will free it */
free_pending_request(req);
return sizeof(struct raw1394_request);
return 0;
} else {
for (dentry =
fi->csr1212_dirs[dr]->value.directory.dentries_head;
Expand All @@ -2311,7 +2311,7 @@ static int state_connected(struct file_info *fi, struct pending_request *req)

case RAW1394_REQ_ECHO:
queue_complete_req(req);
return sizeof(struct raw1394_request);
return 0;

case RAW1394_REQ_ISO_SEND:
print_old_iso_deprecation();
Expand All @@ -2335,24 +2335,24 @@ static int state_connected(struct file_info *fi, struct pending_request *req)
case RAW1394_REQ_ISO_LISTEN:
print_old_iso_deprecation();
handle_iso_listen(fi, req);
return sizeof(struct raw1394_request);
return 0;

case RAW1394_REQ_FCP_LISTEN:
handle_fcp_listen(fi, req);
return sizeof(struct raw1394_request);
return 0;

case RAW1394_REQ_RESET_BUS:
if (req->req.misc == RAW1394_LONG_RESET) {
DBGMSG("busreset called (type: LONG)");
hpsb_reset_bus(fi->host, LONG_RESET);
free_pending_request(req); /* we have to free the request, because we queue no response, and therefore nobody will free it */
return sizeof(struct raw1394_request);
return 0;
}
if (req->req.misc == RAW1394_SHORT_RESET) {
DBGMSG("busreset called (type: SHORT)");
hpsb_reset_bus(fi->host, SHORT_RESET);
free_pending_request(req); /* we have to free the request, because we queue no response, and therefore nobody will free it */
return sizeof(struct raw1394_request);
return 0;
}
/* error EINVAL (22) invalid argument */
return (-EINVAL);
Expand All @@ -2371,7 +2371,7 @@ static int state_connected(struct file_info *fi, struct pending_request *req)
req->req.generation = get_hpsb_generation(fi->host);
req->req.length = 0;
queue_complete_req(req);
return sizeof(struct raw1394_request);
return 0;
}

switch (req->req.type) {
Expand All @@ -2384,7 +2384,7 @@ static int state_connected(struct file_info *fi, struct pending_request *req)
if (req->req.length == 0) {
req->req.error = RAW1394_ERROR_INVALID_ARG;
queue_complete_req(req);
return sizeof(struct raw1394_request);
return 0;
}

return handle_async_request(fi, req, node);
Expand All @@ -2395,7 +2395,7 @@ static ssize_t raw1394_write(struct file *file, const char __user * buffer,
{
struct file_info *fi = (struct file_info *)file->private_data;
struct pending_request *req;
ssize_t retval = 0;
ssize_t retval = -EBADFD;

#ifdef CONFIG_COMPAT
if (count == sizeof(struct compat_raw1394_req) &&
Expand Down Expand Up @@ -2437,6 +2437,9 @@ static ssize_t raw1394_write(struct file *file, const char __user * buffer,

if (retval < 0) {
free_pending_request(req);
} else {
BUG_ON(retval);
retval = count;
}

return retval;
Expand Down

0 comments on commit 883b97e

Please sign in to comment.