Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e3376dca authored by Roel Kluin's avatar Roel Kluin Committed by David S. Miller
Browse files

[WAN]: lmc_ioctl: don't return with locks held 



(akpm: it's doing copy_to_user() inside spin_lock_irqsave(): this driver
appears to be beyond help).

Signed-off-by: default avatarRoel Kluin <12o3l@tiscali.nl>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 521c2a43

drivers/net/wan/lmc/lmc_main.c

+34 −21
Original line number Diff line number Diff line
@@ -143,7 +143,8 @@ int lmc_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd) /*fold00*/ 
         */

    case LMCIOCGINFO: /*fold01*/

	if (copy_to_user(ifr->ifr_data, &sc->ictl, sizeof(lmc_ctl_t)))

            return -EFAULT;

		ret = -EFAULT;

	else

		ret = 0;

        break;
@@ -159,8 +160,10 @@ int lmc_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd) /*fold00*/ 
            break;

        }



        if (copy_from_user(&ctl, ifr->ifr_data, sizeof (lmc_ctl_t)))

            return -EFAULT;

	if (copy_from_user(&ctl, ifr->ifr_data, sizeof(lmc_ctl_t))) {

		ret = -EFAULT;

		break;

	}



        sc->lmc_media->set_status (sc, &ctl);
@@ -190,8 +193,10 @@ int lmc_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd) /*fold00*/ 
		break;

	    }



	    if (copy_from_user(&new_type, ifr->ifr_data, sizeof(u_int16_t)))

                return -EFAULT;

	    if (copy_from_user(&new_type, ifr->ifr_data, sizeof(u_int16_t))) {

		ret = -EFAULT;

		break;

	    }



            

	    if (new_type == old_type)
@@ -229,8 +234,9 @@ int lmc_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd) /*fold00*/ 
        sc->lmc_xinfo.Magic1 = 0xDEADBEEF;



        if (copy_to_user(ifr->ifr_data, &sc->lmc_xinfo,

                         sizeof (struct lmc_xinfo)))

            return -EFAULT;

					sizeof(struct lmc_xinfo))) {

		ret = -EFAULT;

	else

		ret = 0;



        break;
@@ -262,8 +268,8 @@ int lmc_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd) /*fold00*/ 


        if (copy_to_user(ifr->ifr_data, &sc->stats,

                         sizeof (struct lmc_statistics)))

            return -EFAULT;



		ret = -EFAULT;

	else

		ret = 0;

        break;
@@ -292,8 +298,10 @@ int lmc_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd) /*fold00*/ 
            break;

        }



        if (copy_from_user(&ctl, ifr->ifr_data, sizeof (lmc_ctl_t)))

            return -EFAULT;

	if (copy_from_user(&ctl, ifr->ifr_data, sizeof(lmc_ctl_t))) {

		ret = -EFAULT;

		break;

	}

        sc->lmc_media->set_circuit_type(sc, ctl.circuit_type);

        sc->ictl.circuit_type = ctl.circuit_type;

        ret = 0;
@@ -318,12 +326,15 @@ int lmc_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd) /*fold00*/ 


#ifdef DEBUG

    case LMCIOCDUMPEVENTLOG:

        if (copy_to_user(ifr->ifr_data, &lmcEventLogIndex, sizeof (u32)))

            return -EFAULT;

	if (copy_to_user(ifr->ifr_data, &lmcEventLogIndex, sizeof(u32))) {

		ret = -EFAULT;

		break;

	}

        if (copy_to_user(ifr->ifr_data + sizeof (u32), lmcEventLogBuf, sizeof (lmcEventLogBuf)))

            return -EFAULT;



		ret = -EFAULT;

	else

		ret = 0;



        break;

#endif /* end ifdef _DBG_EVENTLOG */

    case LMCIOCT1CONTROL: /*fold01*/
@@ -346,8 +357,10 @@ int lmc_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd) /*fold00*/ 
             */

            netif_stop_queue(dev);



            if (copy_from_user(&xc, ifr->ifr_data, sizeof (struct lmc_xilinx_control)))

                return -EFAULT;

	if (copy_from_user(&xc, ifr->ifr_data, sizeof(struct lmc_xilinx_control))) {

		ret = -EFAULT;

		break;

	}

            switch(xc.command){

            case lmc_xilinx_reset: /*fold02*/

                {