Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 979c407e authored by Alan Cox's avatar Alan Cox Committed by Jiri Kosina
Browse files

HID: Push down BKL into ioctl handler in hidraw 



In this case I simply wrapped it as code review suggests the locking
already terminally broken and I didn't want to make it first. See added
comment

Signed-off-by: default avatarAlan Cox <alan@redhat.com>
Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
parent 7961df16

drivers/hid/hidraw.c

+24 −22
Original line number Diff line number Diff line
@@ -105,6 +105,7 @@ static ssize_t hidraw_read(struct file *file, char __user *buffer, size_t count, 
static ssize_t hidraw_write(struct file *file, const char __user *buffer, size_t count, loff_t *ppos)

{

	unsigned int minor = iminor(file->f_path.dentry->d_inode);

	/* FIXME: What stops hidraw_table going NULL */

	struct hid_device *dev = hidraw_table[minor]->hid;

	__u8 *buf;

	int ret = 0;
@@ -214,35 +215,38 @@ static int hidraw_release(struct inode * inode, struct file * file) 
	return 0;

}



static int hidraw_ioctl(struct inode *inode, struct file *file, unsigned int cmd, unsigned long arg)

static long hidraw_ioctl(struct file *file, unsigned int cmd,

							unsigned long arg)

{

	struct inode *inode = file->f_path.dentry->d_inode;

	unsigned int minor = iminor(inode);

	long ret = 0;

	/* FIXME: What stops hidraw_table going NULL */

	struct hidraw *dev = hidraw_table[minor];

	void __user *user_arg = (void __user*) arg;



	lock_kernel();

	switch (cmd) {

		case HIDIOCGRDESCSIZE:

			if (put_user(dev->hid->rsize, (int __user *)arg))

				return -EFAULT;

			return 0;

				ret = -EFAULT;

			break;



		case HIDIOCGRDESC:

			{

				__u32 len;



				if (get_user(len, (int __user *)arg))

					return -EFAULT;



				if (len > HID_MAX_DESCRIPTOR_SIZE - 1)

					return -EINVAL;



				if (copy_to_user(user_arg + offsetof(

					ret = -EFAULT;

				else if (len > HID_MAX_DESCRIPTOR_SIZE - 1)

					ret = -EINVAL;

				else if (copy_to_user(user_arg + offsetof(

					struct hidraw_report_descriptor,

					value[0]),

					dev->hid->rdesc,

					min(dev->hid->rsize, len)))

						return -EFAULT;

				return 0;

					ret = -EFAULT;

				break;

			}

		case HIDIOCGRAWINFO:

			{
@@ -252,15 +256,13 @@ static int hidraw_ioctl(struct inode *inode, struct file *file, unsigned int cmd 
				dinfo.vendor = dev->hid->vendor;

				dinfo.product = dev->hid->product;

				if (copy_to_user(user_arg, &dinfo, sizeof(dinfo)))

					return -EFAULT;



				return 0;

					ret = -EFAULT;

				break;

			}

		default:

			printk(KERN_EMERG "hidraw: unsupported ioctl() %x\n",

					cmd);

			ret = -ENOTTY;

	}

	return -EINVAL;

	return ret;

}



static const struct file_operations hidraw_ops = {
@@ -270,7 +272,7 @@ static const struct file_operations hidraw_ops = { 
	.poll =         hidraw_poll,

	.open =         hidraw_open,

	.release =      hidraw_release,

	.ioctl =        hidraw_ioctl,

	.unlocked_ioctl = hidraw_ioctl,

};



void hidraw_report_event(struct hid_device *hid, u8 *data, int len)