[PATCH] USB: fix check_ctrlrecip to allow control transfers in state ADDRESS

[linux-2.6-omap-h63xx.git] / drivers / usb / core / devio.c

diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index 2bd742ba812d632ca3578fcbe575012b4d5beb49..545da37afca7bdec6f464d547d575f02570d10cc 100644 (file)
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -134,26 +134,21 @@ static ssize_t usbdev_read(struct file *file, char __user *buf, size_t nbytes, l
        }
 
        if (pos < sizeof(struct usb_device_descriptor)) {
-               struct usb_device_descriptor *desc = kmalloc(sizeof(*desc), GFP_KERNEL);
-               if (!desc) {
-                       ret = -ENOMEM;
-                       goto err;
-               }
-               memcpy(desc, &dev->descriptor, sizeof(dev->descriptor));
-               le16_to_cpus(&desc->bcdUSB);
-               le16_to_cpus(&desc->idVendor);
-               le16_to_cpus(&desc->idProduct);
-               le16_to_cpus(&desc->bcdDevice);
+               struct usb_device_descriptor temp_desc ; /* 18 bytes - fits on the stack */
+
+               memcpy(&temp_desc, &dev->descriptor, sizeof(dev->descriptor));
+               le16_to_cpus(&temp_desc.bcdUSB);
+               le16_to_cpus(&temp_desc.idVendor);
+               le16_to_cpus(&temp_desc.idProduct);
+               le16_to_cpus(&temp_desc.bcdDevice);
 
                len = sizeof(struct usb_device_descriptor) - pos;
                if (len > nbytes)
                        len = nbytes;
-               if (copy_to_user(buf, ((char *)desc) + pos, len)) {
-                       kfree(desc);
+               if (copy_to_user(buf, ((char *)&temp_desc) + pos, len)) {
                        ret = -EFAULT;
                        goto err;
                }
-               kfree(desc);
 
                *ppos += len;
                buf += len;
@@ -210,10 +205,10 @@ err:
 static struct async *alloc_async(unsigned int numisoframes)
 {
         unsigned int assize = sizeof(struct async) + numisoframes * sizeof(struct usb_iso_packet_descriptor);
-        struct async *as = kmalloc(assize, GFP_KERNEL);
+        struct async *as = kzalloc(assize, GFP_KERNEL);
+
         if (!as)
                 return NULL;
-        memset(as, 0, assize);
        as->urb = usb_alloc_urb(numisoframes, GFP_KERNEL);
        if (!as->urb) {
                kfree(as);
@@ -402,7 +397,6 @@ static void driver_disconnect(struct usb_interface *intf)
 }
 
 struct usb_driver usbfs_driver = {
-       .owner =        THIS_MODULE,
        .name =         "usbfs",
        .probe =        driver_probe,
        .disconnect =   driver_disconnect,
@@ -499,7 +493,8 @@ static int check_ctrlrecip(struct dev_state *ps, unsigned int requesttype, unsig
 {
        int ret = 0;
 
-       if (ps->dev->state != USB_STATE_CONFIGURED)
+       if (ps->dev->state != USB_STATE_ADDRESS
+        && ps->dev->state != USB_STATE_CONFIGURED)
                return -EHOSTUNREACH;
        if (USB_TYPE_VENDOR == (USB_TYPE_MASK & requesttype))
                return 0;
@@ -1301,23 +1296,20 @@ static int proc_releaseinterface(struct dev_state *ps, void __user *arg)
        return 0;
 }
 
-static int proc_ioctl (struct dev_state *ps, void __user *arg)
+static int proc_ioctl(struct dev_state *ps, struct usbdevfs_ioctl *ctl)
 {
-       struct usbdevfs_ioctl   ctrl;
        int                     size;
        void                    *buf = NULL;
        int                     retval = 0;
        struct usb_interface    *intf = NULL;
        struct usb_driver       *driver = NULL;
 
-       /* get input parameters and alloc buffer */
-       if (copy_from_user(&ctrl, arg, sizeof (ctrl)))
-               return -EFAULT;
-       if ((size = _IOC_SIZE (ctrl.ioctl_code)) > 0) {
+       /* alloc buffer */
+       if ((size = _IOC_SIZE (ctl->ioctl_code)) > 0) {
                if ((buf = kmalloc (size, GFP_KERNEL)) == NULL)
                        return -ENOMEM;
-               if ((_IOC_DIR(ctrl.ioctl_code) & _IOC_WRITE)) {
-                       if (copy_from_user (buf, ctrl.data, size)) {
+               if ((_IOC_DIR(ctl->ioctl_code) & _IOC_WRITE)) {
+                       if (copy_from_user (buf, ctl->data, size)) {
                                kfree(buf);
                                return -EFAULT;
                        }
@@ -1333,9 +1325,9 @@ static int proc_ioctl (struct dev_state *ps, void __user *arg)
 
        if (ps->dev->state != USB_STATE_CONFIGURED)
                retval = -EHOSTUNREACH;
-       else if (!(intf = usb_ifnum_to_if (ps->dev, ctrl.ifno)))
+       else if (!(intf = usb_ifnum_to_if (ps->dev, ctl->ifno)))
                retval = -EINVAL;
-       else switch (ctrl.ioctl_code) {
+       else switch (ctl->ioctl_code) {
 
        /* disconnect kernel driver from interface */
        case USBDEVFS_DISCONNECT:
@@ -1353,9 +1345,7 @@ static int proc_ioctl (struct dev_state *ps, void __user *arg)
        /* let kernel drivers try to (re)bind to the interface */
        case USBDEVFS_CONNECT:
                usb_unlock_device(ps->dev);
-               usb_lock_all_devices();
                bus_rescan_devices(intf->dev.bus);
-               usb_unlock_all_devices();
                usb_lock_device(ps->dev);
                break;
 
@@ -1367,7 +1357,7 @@ static int proc_ioctl (struct dev_state *ps, void __user *arg)
                if (driver == NULL || driver->ioctl == NULL) {
                        retval = -ENOTTY;
                } else {
-                       retval = driver->ioctl (intf, ctrl.ioctl_code, buf);
+                       retval = driver->ioctl (intf, ctl->ioctl_code, buf);
                        if (retval == -ENOIOCTLCMD)
                                retval = -ENOTTY;
                }
@@ -1376,15 +1366,42 @@ static int proc_ioctl (struct dev_state *ps, void __user *arg)
 
        /* cleanup and return */
        if (retval >= 0
-                       && (_IOC_DIR (ctrl.ioctl_code) & _IOC_READ) != 0
+                       && (_IOC_DIR (ctl->ioctl_code) & _IOC_READ) != 0
                        && size > 0
-                       && copy_to_user (ctrl.data, buf, size) != 0)
+                       && copy_to_user (ctl->data, buf, size) != 0)
                retval = -EFAULT;
 
        kfree(buf);
        return retval;
 }
 
+static int proc_ioctl_default(struct dev_state *ps, void __user *arg)
+{
+       struct usbdevfs_ioctl   ctrl;
+
+       if (copy_from_user(&ctrl, arg, sizeof (ctrl)))
+               return -EFAULT;
+       return proc_ioctl(ps, &ctrl);
+}
+
+#ifdef CONFIG_COMPAT
+static int proc_ioctl_compat(struct dev_state *ps, compat_uptr_t arg)
+{
+       struct usbdevfs_ioctl32 __user *uioc;
+       struct usbdevfs_ioctl ctrl;
+       u32 udata;
+
+       uioc = compat_ptr((long)arg);
+       if (get_user(ctrl.ifno, &uioc->ifno) ||
+           get_user(ctrl.ioctl_code, &uioc->ioctl_code) ||
+           __get_user(udata, &uioc->data))
+               return -EFAULT;
+       ctrl.data = compat_ptr(udata);
+
+       return proc_ioctl(ps, &ctrl);
+}
+#endif
+
 /*
  * NOTE:  All requests here that have interface numbers as parameters
  * are assuming that somehow the configuration has been prevented from
@@ -1485,6 +1502,10 @@ static int usbdev_ioctl(struct inode *inode, struct file *file, unsigned int cmd
                ret = proc_reapurbnonblock_compat(ps, p);
                break;
 
+       case USBDEVFS_IOCTL32:
+               snoop(&dev->dev, "%s: IOCTL\n", __FUNCTION__);
+               ret = proc_ioctl_compat(ps, (compat_uptr_t)(long)p);
+               break;
 #endif
 
        case USBDEVFS_DISCARDURB:
@@ -1519,7 +1540,7 @@ static int usbdev_ioctl(struct inode *inode, struct file *file, unsigned int cmd
 
        case USBDEVFS_IOCTL:
                snoop(&dev->dev, "%s: IOCTL\n", __FUNCTION__);
-               ret = proc_ioctl(ps, p);
+               ret = proc_ioctl_default(ps, p);
                break;
        }
        usb_unlock_device(dev);