Commit 42b8ce6f authored Jan 27, 2015 by Ian Abbott Committed by Greg Kroah-Hartman Jan 28, 2015

staging: comedi: comedi_compat32.c: fix COMEDI_CMD copy back



`do_cmd_ioctl()` in "comedi_fops.c" handles the `COMEDI_CMD` ioctl.
This returns `-EAGAIN` if it has copied a modified `struct comedi_cmd`
back to user-space.  (This occurs when the low-level Comedi driver's
`do_cmdtest()` handler returns non-zero to indicate a problem with the
contents of the `struct comedi_cmd`, or when the `struct comedi_cmd` has
the `CMDF_BOGUS` flag set.)

`compat_cmd()` in "comedi_compat32.c" handles the 32-bit compatible
version of the `COMEDI_CMD` ioctl.  Currently, it never copies a 32-bit
compatible version of `struct comedi_cmd` back to user-space, which is
at odds with the way the regular `COMEDI_CMD` ioctl is handled.  To fix
it, change `compat_cmd()` to copy a 32-bit compatible version of the
`struct comedi_cmd` back to user-space when the main ioctl handler
returns `-EAGAIN`.

Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Reviewed-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent c7d623d3

drivers/staging/comedi/comedi_compat32.c

+10 −2

Original line number	Diff line number	Diff line
		@@ -262,7 +262,7 @@ static int compat_cmd(struct file *file, unsigned long arg)
		{
		struct comedi_cmd __user *cmd;
		struct comedi32_cmd_struct __user *cmd32;
		int rc;
		int rc, err;

		cmd32 = compat_ptr(arg);
		cmd = compat_alloc_user_space(sizeof(*cmd));
		@@ -271,7 +271,15 @@ static int compat_cmd(struct file *file, unsigned long arg)
		if (rc)
		return rc;

		return translated_ioctl(file, COMEDI_CMD, (unsigned long)cmd);
		rc = translated_ioctl(file, COMEDI_CMD, (unsigned long)cmd);
		if (rc == -EAGAIN) {
		/* Special case: copy cmd back to user. */
		err = put_compat_cmd(cmd32, cmd);
		if (err)
		rc = err;
		}

		return rc;
		}

		/* Handle 32-bit COMEDI_CMDTEST ioctl. */