From: Greg Kroah-Hartman Date: Tue, 16 Nov 2010 18:44:50 +0000 (-0800) Subject: Staging: Merge 2.6.37-rc2 into staging-next X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=491acf0032c08a74a4c88032ca1c03b498bfec37;p=GitHub%2FLineageOS%2FG12%2Fandroid_kernel_amlogic_linux-4.9.git Staging: Merge 2.6.37-rc2 into staging-next This was necessary in order to resolve some conflicts that happened between -rc1 and -rc2 with the following files: drivers/staging/bcm/Bcmchar.c drivers/staging/intel_sst/intel_sst_app_interface.c All should be resolved now. Signed-off-by: Greg Kroah-Hartman --- 491acf0032c08a74a4c88032ca1c03b498bfec37 diff --cc drivers/staging/bcm/Bcmchar.c index 8089d19e6c1b,fead9c56162e..31674ea1cd48 --- a/drivers/staging/bcm/Bcmchar.c +++ b/drivers/staging/bcm/Bcmchar.c @@@ -907,9 -999,11 +907,10 @@@ static long bcm_char_ioctl(struct file up(&Adapter->NVMRdmWrmLock); break; } -#endif case IOCTL_BE_BUCKET_SIZE: - Adapter->BEBucketSize = *(PULONG)arg; - Status = STATUS_SUCCESS; + Status = 0; + if (get_user(Adapter->BEBucketSize, (unsigned long __user *)arg)) + Status = -EFAULT; break; case IOCTL_RTPS_BUCKET_SIZE: @@@ -997,16 -1108,19 +1003,19 @@@ Status = -EFAULT; break; } - - if (IoBuffer.OutputLength != sizeof(plink_state)) { ++ if (IoBuffer.OutputLength != sizeof(link_state)) { + Status = -EINVAL; + break; + } - if (copy_from_user(&plink_state, (void __user *)arg, sizeof(plink_state))) { - Status = -EFAULT; - break; - } - plink_state.bIdleMode = (UCHAR)Adapter->IdleMode; - plink_state.bShutdownMode = Adapter->bShutStatus; - plink_state.ucLinkStatus = (UCHAR)Adapter->LinkStatus; - if (copy_to_user(IoBuffer.OutputBuffer, &plink_state, IoBuffer.OutputLength)) { + memset(&link_state, 0, sizeof(link_state)); + link_state.bIdleMode = Adapter->IdleMode; + link_state.bShutdownMode = Adapter->bShutStatus; + link_state.ucLinkStatus = Adapter->LinkStatus; + + if (copy_to_user(IoBuffer.OutputBuffer, &link_state, + min_t(size_t, sizeof(link_state), IoBuffer.OutputLength))) + { BCM_DEBUG_PRINT(Adapter,DBG_TYPE_PRINTK, 0, 0, "Copy_to_user Failed..\n"); Status = -EFAULT; break; diff --cc drivers/staging/intel_sst/intel_sst_app_interface.c index fb718d47f54b,9618c7997461..09909559a922 --- a/drivers/staging/intel_sst/intel_sst_app_interface.c +++ b/drivers/staging/intel_sst/intel_sst_app_interface.c @@@ -246,8 -244,9 +246,9 @@@ static int intel_sst_mmap_play_capture( int retval, i; struct stream_info *stream; struct snd_sst_mmap_buff_entry *buf_entry; + struct snd_sst_mmap_buff_entry *tmp_buf; - pr_debug("sst:called for str_id %d\n", str_id); + pr_debug("called for str_id %d\n", str_id); retval = sst_validate_strid(str_id); if (retval) return -EINVAL; @@@ -264,14 -262,24 +264,24 @@@ stream->curr_bytes = 0; stream->cumm_bytes = 0; + tmp_buf = kcalloc(mmap_buf->entries, sizeof(*tmp_buf), GFP_KERNEL); + if (!tmp_buf) + return -ENOMEM; + if (copy_from_user(tmp_buf, (void __user *)mmap_buf->buff, + mmap_buf->entries * sizeof(*tmp_buf))) { + retval = -EFAULT; + goto out_free; + } + - pr_debug("sst:new buffers count %d status %d\n", + pr_debug("new buffers count %d status %d\n", mmap_buf->entries, stream->status); - buf_entry = mmap_buf->buff; + buf_entry = tmp_buf; for (i = 0; i < mmap_buf->entries; i++) { - BUG_ON(!buf_entry); bufs = kzalloc(sizeof(*bufs), GFP_KERNEL); - if (!bufs) - return -ENOMEM; + if (!bufs) { + retval = -ENOMEM; + goto out_free; + } bufs->size = buf_entry->size; bufs->offset = buf_entry->offset; bufs->addr = sst_drv_ctx->mmap_mem; @@@ -293,15 -301,17 +303,17 @@@ stream->status = STREAM_RUNNING; if (stream->ops == STREAM_OPS_PLAYBACK) { if (sst_play_frame(str_id) < 0) { - pr_warn("sst: play frames fail\n"); + pr_warn("play frames fail\n"); mutex_unlock(&stream->lock); - return -EIO; + retval = -EIO; + goto out_free; } } else if (stream->ops == STREAM_OPS_CAPTURE) { if (sst_capture_frame(str_id) < 0) { - pr_warn("sst: capture frame fail\n"); + pr_warn("capture frame fail\n"); mutex_unlock(&stream->lock); - return -EIO; + retval = -EIO; + goto out_free; } } } @@@ -315,7 -325,10 +327,10 @@@ if (retval >= 0) retval = stream->cumm_bytes; - pr_debug("sst:end of play/rec ioctl bytes = %d!!\n", retval); + pr_debug("end of play/rec ioctl bytes = %d!!\n", retval); + + out_free: + kfree(tmp_buf); return retval; } @@@ -840,9 -851,9 +853,9 @@@ long intel_sst_ioctl(struct file *file_ break; case _IOC_NR(SNDRV_SST_STREAM_SET_PARAMS): { - struct snd_sst_params *str_param = (struct snd_sst_params *)arg; + struct snd_sst_params str_param; - pr_debug("sst: IOCTL_SET_PARAMS recieved!\n"); + pr_debug("IOCTL_SET_PARAMS received!\n"); if (minor != STREAM_MODULE) { retval = -EBADRQC; break; @@@ -866,9 -885,9 +887,9 @@@ retval = -EINVAL; } } else { - pr_debug("sst: SET_STREAM_PARAMS recieved!\n"); + pr_debug("SET_STREAM_PARAMS received!\n"); /* allocated set params only */ - retval = sst_set_stream_param(str_id, str_param); + retval = sst_set_stream_param(str_id, &str_param); /* Block the call for reply */ if (!retval) { int sfreq = 0, word_size = 0, num_channel = 0; @@@ -887,37 -904,36 +906,36 @@@ break; } case _IOC_NR(SNDRV_SST_SET_VOL): { - struct snd_sst_vol *set_vol; - struct snd_sst_vol *rec_vol = (struct snd_sst_vol *)arg; - pr_debug("SET_VOLUME received for %d!\n", - rec_vol->stream_id); - if (minor == STREAM_MODULE && rec_vol->stream_id == 0) { - pr_debug("invalid operation!\n"); - retval = -EPERM; - break; - } - set_vol = kzalloc(sizeof(*set_vol), GFP_ATOMIC); - if (!set_vol) { - pr_debug("mem allocation failed\n"); - retval = -ENOMEM; - break; - } - if (copy_from_user(set_vol, rec_vol, sizeof(*set_vol))) { + struct snd_sst_vol set_vol; + + if (copy_from_user(&set_vol, (void __user *)arg, + sizeof(set_vol))) { - pr_debug("sst: copy failed\n"); + pr_debug("copy failed\n"); retval = -EFAULT; break; } - retval = sst_set_vol(set_vol); - kfree(set_vol); - pr_debug("sst: SET_VOLUME recieved for %d!\n", ++ pr_debug("SET_VOLUME recieved for %d!\n", + set_vol.stream_id); + if (minor == STREAM_MODULE && set_vol.stream_id == 0) { - pr_debug("sst: invalid operation!\n"); ++ pr_debug("invalid operation!\n"); + retval = -EPERM; + break; + } + retval = sst_set_vol(&set_vol); break; } case _IOC_NR(SNDRV_SST_GET_VOL): { - struct snd_sst_vol *rec_vol = (struct snd_sst_vol *)arg; struct snd_sst_vol get_vol; - pr_debug("IOCTL_GET_VOLUME received for stream = %d!\n", - rec_vol->stream_id); - if (minor == STREAM_MODULE && rec_vol->stream_id == 0) { + + if (copy_from_user(&get_vol, (void __user *)arg, + sizeof(get_vol))) { + retval = -EFAULT; + break; + } - pr_debug("sst: IOCTL_GET_VOLUME recieved for stream = %d!\n", ++ pr_debug("IOCTL_GET_VOLUME recieved for stream = %d!\n", + get_vol.stream_id); + if (minor == STREAM_MODULE && get_vol.stream_id == 0) { - pr_debug("sst: invalid operation!\n"); + pr_debug("invalid operation!\n"); retval = -EPERM; break; } @@@ -927,10 -942,10 +944,10 @@@ retval = -EIO; break; } - pr_debug("sst: id:%d\n, vol:%d, ramp_dur:%d, ramp_type:%d\n", + pr_debug("id:%d\n, vol:%d, ramp_dur:%d, ramp_type:%d\n", get_vol.stream_id, get_vol.volume, get_vol.ramp_duration, get_vol.ramp_type); - if (copy_to_user((struct snd_sst_vol *)arg, + if (copy_to_user((struct snd_sst_vol __user *)arg, &get_vol, sizeof(get_vol))) { retval = -EFAULT; break; @@@ -940,25 -955,20 +957,20 @@@ } case _IOC_NR(SNDRV_SST_MUTE): { - struct snd_sst_mute *set_mute; - struct snd_sst_vol *rec_mute = (struct snd_sst_vol *)arg; - pr_debug("SNDRV_SST_SET_VOLUME received for %d!\n", - rec_mute->stream_id); - if (minor == STREAM_MODULE && rec_mute->stream_id == 0) { - retval = -EPERM; - break; - } - set_mute = kzalloc(sizeof(*set_mute), GFP_ATOMIC); - if (!set_mute) { - retval = -ENOMEM; + struct snd_sst_mute set_mute; + + if (copy_from_user(&set_mute, (void __user *)arg, + sizeof(set_mute))) { + retval = -EFAULT; break; } - if (copy_from_user(set_mute, rec_mute, sizeof(*set_mute))) { - retval = -EFAULT; - pr_debug("sst: SNDRV_SST_SET_VOLUME recieved for %d!\n", ++ pr_debug("SNDRV_SST_SET_VOLUME recieved for %d!\n", + set_mute.stream_id); + if (minor == STREAM_MODULE && set_mute.stream_id == 0) { + retval = -EPERM; break; } - retval = sst_set_mute(set_mute); - kfree(set_mute); + retval = sst_set_mute(&set_mute); break; } case _IOC_NR(SNDRV_SST_STREAM_GET_PARAMS): { @@@ -985,18 -995,24 +997,24 @@@ } case _IOC_NR(SNDRV_SST_MMAP_PLAY): - case _IOC_NR(SNDRV_SST_MMAP_CAPTURE): - pr_debug("SNDRV_SST_MMAP_PLAY/CAPTURE received!\n"); + case _IOC_NR(SNDRV_SST_MMAP_CAPTURE): { + struct snd_sst_mmap_buffs mmap_buf; + - pr_debug("sst: SNDRV_SST_MMAP_PLAY/CAPTURE recieved!\n"); ++ pr_debug("SNDRV_SST_MMAP_PLAY/CAPTURE recieved!\n"); if (minor != STREAM_MODULE) { retval = -EBADRQC; break; } - retval = intel_sst_mmap_play_capture(str_id, - (struct snd_sst_mmap_buffs *)arg); + if (copy_from_user(&mmap_buf, (void __user *)arg, + sizeof(mmap_buf))) { + retval = -EFAULT; + break; + } + retval = intel_sst_mmap_play_capture(str_id, &mmap_buf); break; - + } case _IOC_NR(SNDRV_SST_STREAM_DROP): - pr_debug("sst: SNDRV_SST_IOCTL_DROP recieved!\n"); + pr_debug("SNDRV_SST_IOCTL_DROP received!\n"); if (minor != STREAM_MODULE) { retval = -EINVAL; break; @@@ -1067,11 -1082,14 +1084,14 @@@ } case _IOC_NR(SNDRV_SST_SET_TARGET_DEVICE): { - struct snd_sst_target_device *target_device; + struct snd_sst_target_device target_device; - pr_debug("SET_TARGET_DEVICE received!\n"); - target_device = (struct snd_sst_target_device *)arg; - BUG_ON(!target_device); - pr_debug("sst: SET_TARGET_DEVICE recieved!\n"); ++ pr_debug("SET_TARGET_DEVICE recieved!\n"); + if (copy_from_user(&target_device, (void __user *)arg, + sizeof(target_device))) { + retval = -EFAULT; + break; + } if (minor != AM_MODULE) { retval = -EBADRQC; break; @@@ -1081,30 -1099,31 +1101,31 @@@ } case _IOC_NR(SNDRV_SST_DRIVER_INFO): { - struct snd_sst_driver_info *info = - (struct snd_sst_driver_info *)arg; + struct snd_sst_driver_info info; - pr_debug("SNDRV_SST_DRIVER_INFO received\n"); - info->version = SST_VERSION_NUM; - pr_debug("sst: SNDRV_SST_DRIVER_INFO recived\n"); ++ pr_debug("SNDRV_SST_DRIVER_INFO recived\n"); + info.version = SST_VERSION_NUM; /* hard coding, shud get sumhow later */ - info->active_pcm_streams = sst_drv_ctx->stream_cnt - + info.active_pcm_streams = sst_drv_ctx->stream_cnt - sst_drv_ctx->encoded_cnt; - info->active_enc_streams = sst_drv_ctx->encoded_cnt; - info->max_pcm_streams = MAX_ACTIVE_STREAM - MAX_ENC_STREAM; - info->max_enc_streams = MAX_ENC_STREAM; - info->buf_per_stream = sst_drv_ctx->mmap_len; + info.active_enc_streams = sst_drv_ctx->encoded_cnt; + info.max_pcm_streams = MAX_ACTIVE_STREAM - MAX_ENC_STREAM; + info.max_enc_streams = MAX_ENC_STREAM; + info.buf_per_stream = sst_drv_ctx->mmap_len; + if (copy_to_user((void __user *)arg, &info, + sizeof(info))) + retval = -EFAULT; break; } case _IOC_NR(SNDRV_SST_STREAM_DECODE): { - struct snd_sst_dbufs *param = - (struct snd_sst_dbufs *)arg, dbufs_local; - int i; + struct snd_sst_dbufs param; + struct snd_sst_dbufs dbufs_local; struct snd_sst_buffs ibufs, obufs; - struct snd_sst_buff_entry ibuf_temp[param->ibufs->entries], - obuf_temp[param->obufs->entries]; + struct snd_sst_buff_entry *ibuf_tmp, *obuf_tmp; + char __user *dest; - pr_debug("sst: SNDRV_SST_STREAM_DECODE recived\n"); + pr_debug("SNDRV_SST_STREAM_DECODE received\n"); if (minor != STREAM_MODULE) { retval = -EBADRQC; break; @@@ -1166,10 -1207,10 +1209,10 @@@ free_iobufs break; case _IOC_NR(SNDRV_SST_STREAM_BYTES_DECODED): { - unsigned long long *bytes = (unsigned long long *)arg; + unsigned long long __user *bytes = (unsigned long long __user *)arg; struct snd_sst_tstamp tstamp = {0}; - pr_debug("sst: STREAM_BYTES_DECODED recieved!\n"); + pr_debug("STREAM_BYTES_DECODED received!\n"); if (minor != STREAM_MODULE) { retval = -EINVAL; break;