Commit e3376dca authored by Roel Kluin's avatar Roel Kluin Committed by David S. Miller

[WAN]: lmc_ioctl: don't return with locks held

(akpm: it's doing copy_to_user() inside spin_lock_irqsave(): this driver
appears to be beyond help).
Signed-off-by: default avatarRoel Kluin <12o3l@tiscali.nl>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 521c2a43
...@@ -142,9 +142,10 @@ int lmc_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd) /*fold00*/ ...@@ -142,9 +142,10 @@ int lmc_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd) /*fold00*/
* To date internally, just copy this out to the user. * To date internally, just copy this out to the user.
*/ */
case LMCIOCGINFO: /*fold01*/ case LMCIOCGINFO: /*fold01*/
if (copy_to_user(ifr->ifr_data, &sc->ictl, sizeof (lmc_ctl_t))) if (copy_to_user(ifr->ifr_data, &sc->ictl, sizeof(lmc_ctl_t)))
return -EFAULT; ret = -EFAULT;
ret = 0; else
ret = 0;
break; break;
case LMCIOCSINFO: /*fold01*/ case LMCIOCSINFO: /*fold01*/
...@@ -159,8 +160,10 @@ int lmc_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd) /*fold00*/ ...@@ -159,8 +160,10 @@ int lmc_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd) /*fold00*/
break; break;
} }
if (copy_from_user(&ctl, ifr->ifr_data, sizeof (lmc_ctl_t))) if (copy_from_user(&ctl, ifr->ifr_data, sizeof(lmc_ctl_t))) {
return -EFAULT; ret = -EFAULT;
break;
}
sc->lmc_media->set_status (sc, &ctl); sc->lmc_media->set_status (sc, &ctl);
...@@ -190,8 +193,10 @@ int lmc_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd) /*fold00*/ ...@@ -190,8 +193,10 @@ int lmc_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd) /*fold00*/
break; break;
} }
if (copy_from_user(&new_type, ifr->ifr_data, sizeof(u_int16_t))) if (copy_from_user(&new_type, ifr->ifr_data, sizeof(u_int16_t))) {
return -EFAULT; ret = -EFAULT;
break;
}
if (new_type == old_type) if (new_type == old_type)
...@@ -229,9 +234,10 @@ int lmc_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd) /*fold00*/ ...@@ -229,9 +234,10 @@ int lmc_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd) /*fold00*/
sc->lmc_xinfo.Magic1 = 0xDEADBEEF; sc->lmc_xinfo.Magic1 = 0xDEADBEEF;
if (copy_to_user(ifr->ifr_data, &sc->lmc_xinfo, if (copy_to_user(ifr->ifr_data, &sc->lmc_xinfo,
sizeof (struct lmc_xinfo))) sizeof(struct lmc_xinfo))) {
return -EFAULT; ret = -EFAULT;
ret = 0; else
ret = 0;
break; break;
...@@ -262,9 +268,9 @@ int lmc_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd) /*fold00*/ ...@@ -262,9 +268,9 @@ int lmc_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd) /*fold00*/
if (copy_to_user(ifr->ifr_data, &sc->stats, if (copy_to_user(ifr->ifr_data, &sc->stats,
sizeof (struct lmc_statistics))) sizeof (struct lmc_statistics)))
return -EFAULT; ret = -EFAULT;
else
ret = 0; ret = 0;
break; break;
case LMCIOCCLEARLMCSTATS: /*fold01*/ case LMCIOCCLEARLMCSTATS: /*fold01*/
...@@ -292,8 +298,10 @@ int lmc_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd) /*fold00*/ ...@@ -292,8 +298,10 @@ int lmc_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd) /*fold00*/
break; break;
} }
if (copy_from_user(&ctl, ifr->ifr_data, sizeof (lmc_ctl_t))) if (copy_from_user(&ctl, ifr->ifr_data, sizeof(lmc_ctl_t))) {
return -EFAULT; ret = -EFAULT;
break;
}
sc->lmc_media->set_circuit_type(sc, ctl.circuit_type); sc->lmc_media->set_circuit_type(sc, ctl.circuit_type);
sc->ictl.circuit_type = ctl.circuit_type; sc->ictl.circuit_type = ctl.circuit_type;
ret = 0; ret = 0;
...@@ -318,12 +326,15 @@ int lmc_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd) /*fold00*/ ...@@ -318,12 +326,15 @@ int lmc_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd) /*fold00*/
#ifdef DEBUG #ifdef DEBUG
case LMCIOCDUMPEVENTLOG: case LMCIOCDUMPEVENTLOG:
if (copy_to_user(ifr->ifr_data, &lmcEventLogIndex, sizeof (u32))) if (copy_to_user(ifr->ifr_data, &lmcEventLogIndex, sizeof(u32))) {
return -EFAULT; ret = -EFAULT;
break;
}
if (copy_to_user(ifr->ifr_data + sizeof (u32), lmcEventLogBuf, sizeof (lmcEventLogBuf))) if (copy_to_user(ifr->ifr_data + sizeof (u32), lmcEventLogBuf, sizeof (lmcEventLogBuf)))
return -EFAULT; ret = -EFAULT;
else
ret = 0;
ret = 0;
break; break;
#endif /* end ifdef _DBG_EVENTLOG */ #endif /* end ifdef _DBG_EVENTLOG */
case LMCIOCT1CONTROL: /*fold01*/ case LMCIOCT1CONTROL: /*fold01*/
...@@ -346,8 +357,10 @@ int lmc_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd) /*fold00*/ ...@@ -346,8 +357,10 @@ int lmc_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd) /*fold00*/
*/ */
netif_stop_queue(dev); netif_stop_queue(dev);
if (copy_from_user(&xc, ifr->ifr_data, sizeof (struct lmc_xilinx_control))) if (copy_from_user(&xc, ifr->ifr_data, sizeof(struct lmc_xilinx_control))) {
return -EFAULT; ret = -EFAULT;
break;
}
switch(xc.command){ switch(xc.command){
case lmc_xilinx_reset: /*fold02*/ case lmc_xilinx_reset: /*fold02*/
{ {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment