Commit f3ee6e63 authored by Arnd Bergmann's avatar Arnd Bergmann
Browse files

compat_ioctl: move CDROM_SEND_PACKET handling into scsi 



There is only one implementation of this ioctl, so move the handling out
of the common block layer code into the place where it's actually needed.

It also gets called indirectly through pktcdvd, which needs to be aware
of this change.

As I noticed, the old implementation of the compat handler failed to
convert the structure on the way out, so the updated fields never got
written back to user space. This is either not important, or it has
never worked and should be fixed now.

Reviewed-by: default avatarBen Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
parent ab0cf1e4

block/compat_ioctl.c

+1 −46
Original line number Diff line number Diff line
@@ -103,18 +103,6 @@ struct compat_cdrom_read_audio { 
	compat_caddr_t		buf;

};



struct compat_cdrom_generic_command {

	unsigned char	cmd[CDROM_PACKET_SIZE];

	compat_caddr_t	buffer;

	compat_uint_t	buflen;

	compat_int_t	stat;

	compat_caddr_t	sense;

	unsigned char	data_direction;

	compat_int_t	quiet;

	compat_int_t	timeout;

	compat_caddr_t	reserved[1];

};



static int compat_cdrom_read_audio(struct block_device *bdev, fmode_t mode,

		unsigned int cmd, unsigned long arg)

{
@@ -142,38 +130,6 @@ static int compat_cdrom_read_audio(struct block_device *bdev, fmode_t mode, 
			(unsigned long)cdread_audio);

}



static int compat_cdrom_generic_command(struct block_device *bdev, fmode_t mode,

		unsigned int cmd, unsigned long arg)

{

	struct cdrom_generic_command __user *cgc;

	struct compat_cdrom_generic_command __user *cgc32;

	u32 data;

	unsigned char dir;

	int itmp;



	cgc = compat_alloc_user_space(sizeof(*cgc));

	cgc32 = compat_ptr(arg);



	if (copy_in_user(&cgc->cmd, &cgc32->cmd, sizeof(cgc->cmd)) ||

	    get_user(data, &cgc32->buffer) ||

	    put_user(compat_ptr(data), &cgc->buffer) ||

	    copy_in_user(&cgc->buflen, &cgc32->buflen,

			 (sizeof(unsigned int) + sizeof(int))) ||

	    get_user(data, &cgc32->sense) ||

	    put_user(compat_ptr(data), &cgc->sense) ||

	    get_user(dir, &cgc32->data_direction) ||

	    put_user(dir, &cgc->data_direction) ||

	    get_user(itmp, &cgc32->quiet) ||

	    put_user(itmp, &cgc->quiet) ||

	    get_user(itmp, &cgc32->timeout) ||

	    put_user(itmp, &cgc->timeout) ||

	    get_user(data, &cgc32->reserved[0]) ||

	    put_user(compat_ptr(data), &cgc->reserved[0]))

		return -EFAULT;



	return __blkdev_driver_ioctl(bdev, mode, cmd, (unsigned long)cgc);

}



struct compat_blkpg_ioctl_arg {

	compat_int_t op;

	compat_int_t flags;
@@ -225,8 +181,6 @@ static int compat_blkdev_driver_ioctl(struct block_device *bdev, fmode_t mode, 
		return compat_hdio_ioctl(bdev, mode, cmd, arg);

	case CDROMREADAUDIO:

		return compat_cdrom_read_audio(bdev, mode, cmd, arg);

	case CDROM_SEND_PACKET:

		return compat_cdrom_generic_command(bdev, mode, cmd, arg);



	/*

	 * No handler required for the ones below, we just need to
@@ -264,6 +218,7 @@ static int compat_blkdev_driver_ioctl(struct block_device *bdev, fmode_t mode, 
	case CDROM_DISC_STATUS:

	case CDROM_CHANGER_NSLOTS:

	case CDROM_GET_CAPABILITY:

	case CDROM_SEND_PACKET:

	/* Ignore cdrom.h about these next 5 ioctls, they absolutely do

	 * not take a struct cdrom_read, instead they take a struct cdrom_msf

	 * which is compatible.

block/scsi_ioctl.c

+132 −53
Original line number Diff line number Diff line
@@ -639,6 +639,136 @@ int get_sg_io_hdr(struct sg_io_hdr *hdr, const void __user *argp) 
}

EXPORT_SYMBOL(get_sg_io_hdr);



#ifdef CONFIG_COMPAT

struct compat_cdrom_generic_command {

	unsigned char	cmd[CDROM_PACKET_SIZE];

	compat_caddr_t	buffer;

	compat_uint_t	buflen;

	compat_int_t	stat;

	compat_caddr_t	sense;

	unsigned char	data_direction;

	compat_int_t	quiet;

	compat_int_t	timeout;

	compat_caddr_t	reserved[1];

};

#endif



static int scsi_get_cdrom_generic_arg(struct cdrom_generic_command *cgc,

				      const void __user *arg)

{

#ifdef CONFIG_COMPAT

	if (in_compat_syscall()) {

		struct compat_cdrom_generic_command cgc32;



		if (copy_from_user(&cgc32, arg, sizeof(cgc32)))

			return -EFAULT;



		*cgc = (struct cdrom_generic_command) {

			.buffer		= compat_ptr(cgc32.buffer),

			.buflen		= cgc32.buflen,

			.stat		= cgc32.stat,

			.sense		= compat_ptr(cgc32.sense),

			.data_direction	= cgc32.data_direction,

			.quiet		= cgc32.quiet,

			.timeout	= cgc32.timeout,

			.reserved[0]	= compat_ptr(cgc32.reserved[0]),

		};

		memcpy(&cgc->cmd, &cgc32.cmd, CDROM_PACKET_SIZE);

		return 0;

	}

#endif

	if (copy_from_user(cgc, arg, sizeof(*cgc)))

		return -EFAULT;



	return 0;

}



static int scsi_put_cdrom_generic_arg(const struct cdrom_generic_command *cgc,

				      void __user *arg)

{

#ifdef CONFIG_COMPAT

	if (in_compat_syscall()) {

		struct compat_cdrom_generic_command cgc32 = {

			.buffer		= (uintptr_t)(cgc->buffer),

			.buflen		= cgc->buflen,

			.stat		= cgc->stat,

			.sense		= (uintptr_t)(cgc->sense),

			.data_direction	= cgc->data_direction,

			.quiet		= cgc->quiet,

			.timeout	= cgc->timeout,

			.reserved[0]	= (uintptr_t)(cgc->reserved[0]),

		};

		memcpy(&cgc32.cmd, &cgc->cmd, CDROM_PACKET_SIZE);



		if (copy_to_user(arg, &cgc32, sizeof(cgc32)))

			return -EFAULT;



		return 0;

	}

#endif

	if (copy_to_user(arg, cgc, sizeof(*cgc)))

		return -EFAULT;



	return 0;

}



static int scsi_cdrom_send_packet(struct request_queue *q,

				  struct gendisk *bd_disk,

				  fmode_t mode, void __user *arg)

{

	struct cdrom_generic_command cgc;

	struct sg_io_hdr hdr;

	int err;



	err = scsi_get_cdrom_generic_arg(&cgc, arg);

	if (err)

		return err;



	cgc.timeout = clock_t_to_jiffies(cgc.timeout);

	memset(&hdr, 0, sizeof(hdr));

	hdr.interface_id = 'S';

	hdr.cmd_len = sizeof(cgc.cmd);

	hdr.dxfer_len = cgc.buflen;

	switch (cgc.data_direction) {

		case CGC_DATA_UNKNOWN:

			hdr.dxfer_direction = SG_DXFER_UNKNOWN;

			break;

		case CGC_DATA_WRITE:

			hdr.dxfer_direction = SG_DXFER_TO_DEV;

			break;

		case CGC_DATA_READ:

			hdr.dxfer_direction = SG_DXFER_FROM_DEV;

			break;

		case CGC_DATA_NONE:

			hdr.dxfer_direction = SG_DXFER_NONE;

			break;

		default:

			return -EINVAL;

	}



	hdr.dxferp = cgc.buffer;

	hdr.sbp = cgc.sense;

	if (hdr.sbp)

		hdr.mx_sb_len = sizeof(struct request_sense);

	hdr.timeout = jiffies_to_msecs(cgc.timeout);

	hdr.cmdp = ((struct cdrom_generic_command __user*) arg)->cmd;

	hdr.cmd_len = sizeof(cgc.cmd);



	err = sg_io(q, bd_disk, &hdr, mode);

	if (err == -EFAULT)

		return -EFAULT;



	if (hdr.status)

		return -EIO;



	cgc.stat = err;

	cgc.buflen = hdr.resid;

	if (scsi_put_cdrom_generic_arg(&cgc, arg))

		return -EFAULT;



	return err;

}



int scsi_cmd_ioctl(struct request_queue *q, struct gendisk *bd_disk, fmode_t mode,

		   unsigned int cmd, void __user *arg)

{
@@ -689,60 +819,9 @@ int scsi_cmd_ioctl(struct request_queue *q, struct gendisk *bd_disk, fmode_t mod 
				err = -EFAULT;

			break;

		}

		case CDROM_SEND_PACKET: {

			struct cdrom_generic_command cgc;

			struct sg_io_hdr hdr;



			err = -EFAULT;

			if (copy_from_user(&cgc, arg, sizeof(cgc)))

		case CDROM_SEND_PACKET:

			err = scsi_cdrom_send_packet(q, bd_disk, mode, arg);

			break;

			cgc.timeout = clock_t_to_jiffies(cgc.timeout);

			memset(&hdr, 0, sizeof(hdr));

			hdr.interface_id = 'S';

			hdr.cmd_len = sizeof(cgc.cmd);

			hdr.dxfer_len = cgc.buflen;

			err = 0;

			switch (cgc.data_direction) {

				case CGC_DATA_UNKNOWN:

					hdr.dxfer_direction = SG_DXFER_UNKNOWN;

					break;

				case CGC_DATA_WRITE:

					hdr.dxfer_direction = SG_DXFER_TO_DEV;

					break;

				case CGC_DATA_READ:

					hdr.dxfer_direction = SG_DXFER_FROM_DEV;

					break;

				case CGC_DATA_NONE:

					hdr.dxfer_direction = SG_DXFER_NONE;

					break;

				default:

					err = -EINVAL;

			}

			if (err)

				break;



			hdr.dxferp = cgc.buffer;

			hdr.sbp = cgc.sense;

			if (hdr.sbp)

				hdr.mx_sb_len = sizeof(struct request_sense);

			hdr.timeout = jiffies_to_msecs(cgc.timeout);

			hdr.cmdp = ((struct cdrom_generic_command __user*) arg)->cmd;

			hdr.cmd_len = sizeof(cgc.cmd);



			err = sg_io(q, bd_disk, &hdr, mode);

			if (err == -EFAULT)

				break;



			if (hdr.status)

				err = -EIO;



			cgc.stat = err;

			cgc.buflen = hdr.resid;

			if (copy_to_user(arg, &cgc, sizeof(cgc)))

				err = -EFAULT;



			break;

		}



		/*

		 * old junk scsi send command ioctl

drivers/block/pktcdvd.c

+2 −4
Original line number Diff line number Diff line
@@ -2671,15 +2671,13 @@ static int pkt_compat_ioctl(struct block_device *bdev, fmode_t mode, unsigned in 
	case CDROMEJECT:

	case CDROMMULTISESSION:

	case CDROMREADTOCENTRY:

	case CDROM_SEND_PACKET: /* compat mode handled in scsi_cmd_ioctl */

	case SCSI_IOCTL_SEND_COMMAND:

		return pkt_ioctl(bdev, mode, cmd, (unsigned long)compat_ptr(arg));





	/* FIXME: no handler so far */

	case CDROM_LAST_WRITTEN:

	/* handled in compat_blkdev_driver_ioctl */

	case CDROM_SEND_PACKET:

	default:

	case CDROM_LAST_WRITTEN:

		return -ENOIOCTLCMD;

	}

}

CRA Git | Maintained and supported by SUSTech CRA and CCSE