dect
/
linux-2.6
Archived
13
0
Fork 0
Code Releases Activity

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394-2.6 

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394-2.6:
  firewire: prevent userspace from accessing shut down devices
  ieee1394: sbp2: use correct size of command descriptor block
This commit is contained in:
Linus Torvalds 2008-05-20 10:12:48 -07:00
parent 81b2dbcad8 551f4cb9de
commit c110a2bd82
2 changed files with 22 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
drivers/firewire/fw-cdev.c
View File

@ -113,6 +113,11 @@ static int fw_device_op_open(struct inode *inode, struct file *file)
if (device == NULL) if (device == NULL)
return -ENODEV; return -ENODEV;
if (fw_device_is_shutdown(device)) {
fw_device_put(device);
return -ENODEV;
}
client = kzalloc(sizeof(*client), GFP_KERNEL); client = kzalloc(sizeof(*client), GFP_KERNEL);
if (client == NULL) { if (client == NULL) {
fw_device_put(device); fw_device_put(device);
@ -901,6 +906,9 @@ fw_device_op_ioctl(struct file *file,
{ {
struct client *client = file->private_data; struct client *client = file->private_data;
if (fw_device_is_shutdown(client->device))
return -ENODEV;
return dispatch_ioctl(client, cmd, (void __user *) arg); return dispatch_ioctl(client, cmd, (void __user *) arg);
} }
@ -911,6 +919,9 @@ fw_device_op_compat_ioctl(struct file *file,
{ {
struct client *client = file->private_data; struct client *client = file->private_data;
if (fw_device_is_shutdown(client->device))
return -ENODEV;
return dispatch_ioctl(client, cmd, compat_ptr(arg)); return dispatch_ioctl(client, cmd, compat_ptr(arg));
} }
#endif #endif
@ -922,6 +933,9 @@ static int fw_device_op_mmap(struct file *file, struct vm_area_struct *vma)
unsigned long size; unsigned long size;
int page_count, retval; int page_count, retval;
if (fw_device_is_shutdown(client->device))
return -ENODEV;
/* FIXME: We could support multiple buffers, but we don't. */ /* FIXME: We could support multiple buffers, but we don't. */
if (client->buffer.pages != NULL) if (client->buffer.pages != NULL)
return -EBUSY; return -EBUSY;

20
drivers/ieee1394/sbp2.c
View File

@ -1539,15 +1539,13 @@ static void sbp2_prep_command_orb_sg(struct sbp2_command_orb *orb,
static void sbp2_create_command_orb(struct sbp2_lu *lu, static void sbp2_create_command_orb(struct sbp2_lu *lu,
struct sbp2_command_info *cmd, struct sbp2_command_info *cmd,
unchar *scsi_cmd, struct scsi_cmnd *SCpnt)
unsigned int scsi_use_sg,
unsigned int scsi_request_bufflen,
struct scatterlist *sg,
enum dma_data_direction dma_dir)
{ {
struct sbp2_fwhost_info *hi = lu->hi; struct sbp2_fwhost_info *hi = lu->hi;
struct sbp2_command_orb *orb = &cmd->command_orb; struct sbp2_command_orb *orb = &cmd->command_orb;
u32 orb_direction; u32 orb_direction;
unsigned int scsi_request_bufflen = scsi_bufflen(SCpnt);
enum dma_data_direction dma_dir = SCpnt->sc_data_direction;
/* /*
* Set-up our command ORB. * Set-up our command ORB.
@ -1580,13 +1578,14 @@ static void sbp2_create_command_orb(struct sbp2_lu *lu,
orb->data_descriptor_lo = 0x0; orb->data_descriptor_lo = 0x0;
orb->misc |= ORB_SET_DIRECTION(1); orb->misc |= ORB_SET_DIRECTION(1);
} else } else
sbp2_prep_command_orb_sg(orb, hi, cmd, scsi_use_sg, sg, sbp2_prep_command_orb_sg(orb, hi, cmd, scsi_sg_count(SCpnt),
scsi_sglist(SCpnt),
orb_direction, dma_dir); orb_direction, dma_dir);
sbp2util_cpu_to_be32_buffer(orb, sizeof(*orb)); sbp2util_cpu_to_be32_buffer(orb, sizeof(*orb));
memset(orb->cdb, 0, 12); memset(orb->cdb, 0, sizeof(orb->cdb));
memcpy(orb->cdb, scsi_cmd, COMMAND_SIZE(*scsi_cmd)); memcpy(orb->cdb, SCpnt->cmnd, SCpnt->cmd_len);
} }
static void sbp2_link_orb_command(struct sbp2_lu *lu, static void sbp2_link_orb_command(struct sbp2_lu *lu,
@ -1669,16 +1668,13 @@ static void sbp2_link_orb_command(struct sbp2_lu *lu,
static int sbp2_send_command(struct sbp2_lu *lu, struct scsi_cmnd *SCpnt, static int sbp2_send_command(struct sbp2_lu *lu, struct scsi_cmnd *SCpnt,
void (*done)(struct scsi_cmnd *)) void (*done)(struct scsi_cmnd *))
{ {
unchar *scsi_cmd = (unchar *)SCpnt->cmnd;
struct sbp2_command_info *cmd; struct sbp2_command_info *cmd;
cmd = sbp2util_allocate_command_orb(lu, SCpnt, done); cmd = sbp2util_allocate_command_orb(lu, SCpnt, done);
if (!cmd) if (!cmd)
return -EIO; return -EIO;
sbp2_create_command_orb(lu, cmd, scsi_cmd, scsi_sg_count(SCpnt), sbp2_create_command_orb(lu, cmd, SCpnt);
scsi_bufflen(SCpnt), scsi_sglist(SCpnt),
SCpnt->sc_data_direction);
sbp2_link_orb_command(lu, cmd); sbp2_link_orb_command(lu, cmd);
return 0; return 0;