From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Mon, 17 Mar 2014 18:27:39 +0000 (-0700)
Subject: Merge 3.14-rc7 into staging-next
X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=e40bffaeaed9c5a26c3e5c961c3dee72c1b46558;p=GitHub%2Fexynos8895%2Fandroid_kernel_samsung_universal8895.git

Merge 3.14-rc7 into staging-next

This resolves a merge issue with drivers/staging/cxt1e1/linux.c that was
fixed in a report from Stephen Rothwell

Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---

e40bffaeaed9c5a26c3e5c961c3dee72c1b46558
diff --cc drivers/staging/cxt1e1/linux.c
index 549efd1fa965,79206cb3fb94..b2a06cafa63e
--- a/drivers/staging/cxt1e1/linux.c
+++ b/drivers/staging/cxt1e1/linux.c
@@@ -867,77 -861,79 +867,79 @@@ c4_ioctl(struct net_device *ndev, struc
  #endif
  
  #if 0
 -    pr_info("c4_ioctl: iocmd %x, dir %x type %x nr %x iolen %d.\n", iocmd,
 -            _IOC_DIR (iocmd), _IOC_TYPE (iocmd), _IOC_NR (iocmd),
 -            _IOC_SIZE (iocmd));
 +	pr_info("c4_ioctl: iocmd %x, dir %x type %x nr %x iolen %d.\n", iocmd,
 +		_IOC_DIR(iocmd), _IOC_TYPE(iocmd), _IOC_NR(iocmd),
 +		_IOC_SIZE(iocmd));
  #endif
 -    iolen = _IOC_SIZE (iocmd);
 -    if (iolen > sizeof(arg))
 -        return -EFAULT;
 -    data = ifr->ifr_data + sizeof (iocmd);
 -    if (copy_from_user (&arg, data, iolen))
 -        return -EFAULT;
 -
 -    ret = 0;
 -    switch (iocmd)
 -    {
 -    case SBE_IOC_PORT_GET:
 -        //pr_info(">> SBE_IOC_PORT_GET Ioctl...\n");
 -        ret = do_get_port (ndev, data);
 -        break;
 -    case SBE_IOC_PORT_SET:
 -        //pr_info(">> SBE_IOC_PORT_SET Ioctl...\n");
 -        ret = do_set_port (ndev, data);
 -        break;
 -    case SBE_IOC_CHAN_GET:
 -        //pr_info(">> SBE_IOC_CHAN_GET Ioctl...\n");
 -        ret = do_get_chan (ndev, data);
 -        break;
 -    case SBE_IOC_CHAN_SET:
 -        //pr_info(">> SBE_IOC_CHAN_SET Ioctl...\n");
 -        ret = do_set_chan (ndev, data);
 -        break;
 -    case C4_DEL_CHAN:
 -        //pr_info(">> C4_DEL_CHAN Ioctl...\n");
 -        ret = do_del_chan (ndev, data);
 -        break;
 -    case SBE_IOC_CHAN_NEW:
 -        ret = do_create_chan (ndev, data);
 -        break;
 -    case SBE_IOC_CHAN_GET_STAT:
 -        ret = do_get_chan_stats (ndev, data);
 -        break;
 -    case SBE_IOC_LOGLEVEL:
 -        ret = do_set_loglevel (ndev, data);
 -        break;
 -    case SBE_IOC_RESET_DEV:
 -        ret = do_reset (ndev, data);
 -        break;
 -    case SBE_IOC_CHAN_DEL_STAT:
 -        ret = do_reset_chan_stats (ndev, data);
 -        break;
 -    case C4_LOOP_PORT:
 -        ret = do_port_loop (ndev, data);
 -        break;
 -    case C4_RW_FRMR:
 -        ret = do_framer_rw (ndev, data);
 -        break;
 -    case C4_RW_MSYC:
 -        ret = do_musycc_rw (ndev, data);
 -        break;
 -    case C4_RW_PLD:
 -        ret = do_pld_rw (ndev, data);
 -        break;
 -    case SBE_IOC_IID_GET:
 -        ret = (iolen == sizeof (struct sbe_iid_info)) ? c4_get_iidinfo (ci, &arg.u.iip) : -EFAULT;
 -        if (ret == 0)               /* no error, copy data */
 -            if (copy_to_user (data, &arg, iolen))
 -                return -EFAULT;
 -        break;
 -    default:
 -        //pr_info(">> c4_ioctl: EINVAL - unknown iocmd <%x>\n", iocmd);
 -        ret = -EINVAL;
 -        break;
 -    }
 -    return mkret (ret);
 +	iolen = _IOC_SIZE(iocmd);
++	if (iolen > sizeof(arg))
++		return -EFAULT;
 +	data = ifr->ifr_data + sizeof(iocmd);
 +	if (copy_from_user(&arg, data, iolen))
 +		return -EFAULT;
 +
 +	ret = 0;
 +	switch (iocmd) {
 +	case SBE_IOC_PORT_GET:
 +		//pr_info(">> SBE_IOC_PORT_GET Ioctl...\n");
 +		ret = do_get_port(ndev, data);
 +		break;
 +	case SBE_IOC_PORT_SET:
 +		//pr_info(">> SBE_IOC_PORT_SET Ioctl...\n");
 +		ret = do_set_port(ndev, data);
 +		break;
 +	case SBE_IOC_CHAN_GET:
 +		//pr_info(">> SBE_IOC_CHAN_GET Ioctl...\n");
 +		ret = do_get_chan(ndev, data);
 +		break;
 +	case SBE_IOC_CHAN_SET:
 +		//pr_info(">> SBE_IOC_CHAN_SET Ioctl...\n");
 +		ret = do_set_chan(ndev, data);
 +		break;
 +	case C4_DEL_CHAN:
 +		//pr_info(">> C4_DEL_CHAN Ioctl...\n");
 +		ret = do_del_chan(ndev, data);
 +		break;
 +	case SBE_IOC_CHAN_NEW:
 +		ret = do_create_chan(ndev, data);
 +		break;
 +	case SBE_IOC_CHAN_GET_STAT:
 +		ret = do_get_chan_stats(ndev, data);
 +		break;
 +	case SBE_IOC_LOGLEVEL:
 +		ret = do_set_loglevel(ndev, data);
 +		break;
 +	case SBE_IOC_RESET_DEV:
 +		ret = do_reset(ndev, data);
 +		break;
 +	case SBE_IOC_CHAN_DEL_STAT:
 +		ret = do_reset_chan_stats(ndev, data);
 +		break;
 +	case C4_LOOP_PORT:
 +		ret = do_port_loop(ndev, data);
 +		break;
 +	case C4_RW_FRMR:
 +		ret = do_framer_rw(ndev, data);
 +		break;
 +	case C4_RW_MSYC:
 +		ret = do_musycc_rw(ndev, data);
 +		break;
 +	case C4_RW_PLD:
 +		ret = do_pld_rw(ndev, data);
 +		break;
 +	case SBE_IOC_IID_GET:
 +		ret = (iolen == sizeof(struct sbe_iid_info)) ?
 +		       c4_get_iidinfo(ci, &arg.u.iip) : -EFAULT;
 +		if (ret == 0)               /* no error, copy data */
 +			if (copy_to_user(data, &arg, iolen))
 +				return -EFAULT;
 +		break;
 +	default:
 +		//pr_info(">> c4_ioctl: EINVAL - unknown iocmd <%x>\n", iocmd);
 +		ret = -EINVAL;
 +		break;
 +	}
 +	return mkret(ret);
  }
  
  static const struct net_device_ops c4_ops = {