| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Thu, 29 Jul 2010 17:32:18 +0400
From: Kulikov Vasiliy <segooon@...il.com>
To: kernel-janitors@...r.kernel.org
Cc: Mikael Starvik <starvik@...s.com>,
Jesper Nilsson <jesper.nilsson@...s.com>,
linux-cris-kernel@...s.com, linux-kernel@...r.kernel.org
Subject: [PATCH] cris: gpio: do not call copy_to_user()/copy_from_user() while holding spinlocks
copy_to_user()/copy_from_user() must not be used with spinlocks held.
Move all cases of interaction with userspace out of global switch and
lock spinlocks only where they are needed.
Signed-off-by: Kulikov Vasiliy <segooon@...il.com>
---
arch/cris/arch-v10/drivers/gpio.c | 96 +++++++++++++++++++------------------
1 files changed, 50 insertions(+), 46 deletions(-)
diff --git a/arch/cris/arch-v10/drivers/gpio.c b/arch/cris/arch-v10/drivers/gpio.c
index 4b0f65f..74e3eed 100644
--- a/arch/cris/arch-v10/drivers/gpio.c
+++ b/arch/cris/arch-v10/drivers/gpio.c
@@ -510,12 +510,61 @@ gpio_ioctl(struct inode *inode, struct file *file,
{
unsigned long flags;
unsigned long val;
- int ret = 0;
+ int ret = 0;
struct gpio_private *priv = file->private_data;
if (_IOC_TYPE(cmd) != ETRAXGPIO_IOCTYPE)
return -EINVAL;
+ switch (_IOC_NR(cmd)) {
+ case IO_READ_INBITS:
+ spin_lock_irqsave(&gpio_lock, flags);
+ /* *arg is result of reading the input pins */
+ if (USE_PORTS(priv))
+ val = *priv->port;
+ else if (priv->minor == GPIO_MINOR_G)
+ val = *R_PORT_G_DATA;
+ spin_unlock_irqrestore(&gpio_lock, flags);
+ if (copy_to_user((void __user *)arg, &val, sizeof(val)))
+ ret = -EFAULT;
+ return ret;
+ case IO_READ_OUTBITS:
+ spin_lock_irqsave(&gpio_lock, flags);
+ /* *arg is result of reading the output shadow */
+ if (USE_PORTS(priv))
+ val = *priv->shadow;
+ else if (priv->minor == GPIO_MINOR_G)
+ val = port_g_data_shadow;
+ spin_unlock_irqrestore(&gpio_lock, flags);
+ if (copy_to_user((void __user *)arg, &val, sizeof(val)))
+ ret = -EFAULT;
+ return ret;
+ case IO_SETGET_INPUT:
+ /* bits set in *arg is set to input,
+ * *arg updated with current input pins.
+ */
+ if (copy_from_user(&val, (void __user *)arg, sizeof(val)))
+ return -EFAULT;
+ spin_lock_irqsave(&gpio_lock, flags);
+ val = setget_input(priv, val);
+ spin_unlock_irqrestore(&gpio_lock, flags);
+ if (copy_to_user((void __user *)arg, &val, sizeof(val)))
+ ret = -EFAULT;
+ return ret;
+ case IO_SETGET_OUTPUT:
+ /* bits set in *arg is set to output,
+ * *arg updated with current output pins.
+ */
+ if (copy_from_user(&val, (void __user *)arg, sizeof(val)))
+ return -EFAULT;
+ spin_lock_irqsave(&gpio_lock, flags);
+ val = setget_output(priv, val);
+ spin_unlock_irqrestore(&gpio_lock, flags);
+ if (copy_to_user((void __user *)arg, &val, sizeof(val)))
+ ret = -EFAULT;
+ return ret;
+ }
+
spin_lock_irqsave(&gpio_lock, flags);
switch (_IOC_NR(cmd)) {
@@ -627,51 +676,6 @@ gpio_ioctl(struct inode *inode, struct file *file,
ret = -EPERM;
}
break;
- case IO_READ_INBITS:
- /* *arg is result of reading the input pins */
- if (USE_PORTS(priv)) {
- val = *priv->port;
- } else if (priv->minor == GPIO_MINOR_G) {
- val = *R_PORT_G_DATA;
- }
- if (copy_to_user((void __user *)arg, &val, sizeof(val)))
- ret = -EFAULT;
- break;
- case IO_READ_OUTBITS:
- /* *arg is result of reading the output shadow */
- if (USE_PORTS(priv)) {
- val = *priv->shadow;
- } else if (priv->minor == GPIO_MINOR_G) {
- val = port_g_data_shadow;
- }
- if (copy_to_user((void __user *)arg, &val, sizeof(val)))
- ret = -EFAULT;
- break;
- case IO_SETGET_INPUT:
- /* bits set in *arg is set to input,
- * *arg updated with current input pins.
- */
- if (copy_from_user(&val, (void __user *)arg, sizeof(val)))
- {
- ret = -EFAULT;
- break;
- }
- val = setget_input(priv, val);
- if (copy_to_user((void __user *)arg, &val, sizeof(val)))
- ret = -EFAULT;
- break;
- case IO_SETGET_OUTPUT:
- /* bits set in *arg is set to output,
- * *arg updated with current output pins.
- */
- if (copy_from_user(&val, (void __user *)arg, sizeof(val))) {
- ret = -EFAULT;
- break;
- }
- val = setget_output(priv, val);
- if (copy_to_user((void __user *)arg, &val, sizeof(val)))
- ret = -EFAULT;
- break;
default:
if (priv->minor == GPIO_MINOR_LEDS)
ret = gpio_leds_ioctl(cmd, arg);
--
1.7.0.4
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists