[PATCH] Fix prctl privilege escalation and suid_dumpable (CVE-2006-2451)
[pandora-kernel.git] / drivers / pcmcia / ds.c
index 4ab9568..74b3124 100644 (file)
@@ -236,11 +236,11 @@ static void pcmcia_check_driver(struct pcmcia_driver *p_drv)
 /**
  * pcmcia_load_firmware - load CIS from userspace if device-provided is broken
  * @dev - the pcmcia device which needs a CIS override
- * @filename - requested filename in /lib/firmware/cis/
+ * @filename - requested filename in /lib/firmware/
  *
  * This uses the in-kernel firmware loading mechanism to use a "fake CIS" if
  * the one provided by the card is broken. The firmware files reside in
- * /lib/firmware/cis/ in userspace.
+ * /lib/firmware/ in userspace.
  */
 static int pcmcia_load_firmware(struct pcmcia_device *dev, char * filename)
 {
@@ -298,9 +298,6 @@ static inline int pcmcia_load_firmware(struct pcmcia_device *dev, char * filenam
  *
  * Registers a PCMCIA driver with the PCMCIA bus core.
  */
-static int pcmcia_device_probe(struct device *dev);
-static int pcmcia_device_remove(struct device * dev);
-
 int pcmcia_register_driver(struct pcmcia_driver *driver)
 {
        if (!driver)
@@ -390,9 +387,6 @@ static int pcmcia_device_probe(struct device * dev)
                goto put_dev;
        }
 
-       p_dev->p_state &= ~CLIENT_UNBOUND;
-       p_dev->handle = p_dev;
-
        ret = p_drv->probe(p_dev);
        if (ret)
                goto put_module;
@@ -403,7 +397,7 @@ static int pcmcia_device_probe(struct device * dev)
         * call which will then check whether there are two
         * pseudo devices, and if not, add the second one.
         */
-       did = (struct pcmcia_device_id *) p_dev->dev.driver_data;
+       did = p_dev->dev.driver_data;
        if (did && (did->match_flags & PCMCIA_DEV_ID_MATCH_DEVICE_NO) &&
            (p_dev->socket->device_count == 1) && (p_dev->device_no == 0))
                pcmcia_add_pseudo_device(p_dev->socket);
@@ -418,33 +412,79 @@ static int pcmcia_device_probe(struct device * dev)
 }
 
 
+/*
+ * Removes a PCMCIA card from the device tree and socket list.
+ */
+static void pcmcia_card_remove(struct pcmcia_socket *s, struct pcmcia_device *leftover)
+{
+       struct pcmcia_device    *p_dev;
+       struct pcmcia_device    *tmp;
+       unsigned long           flags;
+
+       ds_dbg(2, "unbind_request(%d)\n", s->sock);
+
+
+       if (!leftover)
+               s->device_count = 0;
+       else
+               s->device_count = 1;
+
+       /* unregister all pcmcia_devices registered with this socket, except leftover */
+       list_for_each_entry_safe(p_dev, tmp, &s->devices_list, socket_device_list) {
+               if (p_dev == leftover)
+                       continue;
+
+               spin_lock_irqsave(&pcmcia_dev_list_lock, flags);
+               list_del(&p_dev->socket_device_list);
+               p_dev->_removed=1;
+               spin_unlock_irqrestore(&pcmcia_dev_list_lock, flags);
+
+               device_unregister(&p_dev->dev);
+       }
+
+       return;
+}
+
 static int pcmcia_device_remove(struct device * dev)
 {
        struct pcmcia_device *p_dev;
        struct pcmcia_driver *p_drv;
+       struct pcmcia_device_id *did;
        int i;
 
-       /* detach the "instance" */
        p_dev = to_pcmcia_dev(dev);
        p_drv = to_pcmcia_drv(dev->driver);
+
+       /* If we're removing the primary module driving a
+        * pseudo multi-function card, we need to unbind
+        * all devices
+        */
+       did = p_dev->dev.driver_data;
+       if (did && (did->match_flags & PCMCIA_DEV_ID_MATCH_DEVICE_NO) &&
+           (p_dev->socket->device_count != 0) &&
+           (p_dev->device_no == 0))
+               pcmcia_card_remove(p_dev->socket, p_dev);
+
+       /* detach the "instance" */
        if (!p_drv)
                return 0;
 
        if (p_drv->remove)
                p_drv->remove(p_dev);
 
+       p_dev->dev_node = NULL;
+
        /* check for proper unloading */
-       if (p_dev->p_state & (CLIENT_IRQ_REQ|CLIENT_IO_REQ|CLIENT_CONFIG_LOCKED))
+       if (p_dev->_irq || p_dev->_io || p_dev->_locked)
                printk(KERN_INFO "pcmcia: driver %s did not release config properly\n",
                       p_drv->drv.name);
 
        for (i = 0; i < MAX_WIN; i++)
-               if (p_dev->p_state & CLIENT_WIN_REQ(i))
+               if (p_dev->_win & CLIENT_WIN_REQ(i))
                        printk(KERN_INFO "pcmcia: driver %s did not release windows properly\n",
                               p_drv->drv.name);
 
        /* references from pcmcia_probe_device */
-       p_dev->p_state = CLIENT_UNBOUND;
        pcmcia_put_dev(p_dev);
        module_put(p_drv->owner);
 
@@ -452,37 +492,6 @@ static int pcmcia_device_remove(struct device * dev)
 }
 
 
-/*
- * Removes a PCMCIA card from the device tree and socket list.
- */
-static void pcmcia_card_remove(struct pcmcia_socket *s)
-{
-       struct pcmcia_device    *p_dev;
-       unsigned long           flags;
-
-       ds_dbg(2, "unbind_request(%d)\n", s->sock);
-
-       s->device_count = 0;
-
-       for (;;) {
-               /* unregister all pcmcia_devices registered with this socket*/
-               spin_lock_irqsave(&pcmcia_dev_list_lock, flags);
-               if (list_empty(&s->devices_list)) {
-                       spin_unlock_irqrestore(&pcmcia_dev_list_lock, flags);
-                       return;
-               }
-               p_dev = list_entry((&s->devices_list)->next, struct pcmcia_device, socket_device_list);
-               list_del(&p_dev->socket_device_list);
-               p_dev->p_state |= CLIENT_STALE;
-               spin_unlock_irqrestore(&pcmcia_dev_list_lock, flags);
-
-               device_unregister(&p_dev->dev);
-       }
-
-       return;
-} /* unbind_request */
-
-
 /*
  * pcmcia_device_query -- determine information about a pcmcia device
  */
@@ -603,9 +612,6 @@ struct pcmcia_device * pcmcia_device_add(struct pcmcia_socket *s, unsigned int f
        sprintf (p_dev->devname, "pcmcia%s", p_dev->dev.bus_id);
 
        /* compat */
-       p_dev->p_state = CLIENT_UNBOUND;
-
-
        spin_lock_irqsave(&pcmcia_dev_list_lock, flags);
 
        /*
@@ -620,7 +626,7 @@ struct pcmcia_device * pcmcia_device_add(struct pcmcia_socket *s, unsigned int f
                }
 
        /* Add to the list in pcmcia_bus_socket */
-       list_add_tail(&p_dev->socket_device_list, &s->devices_list);
+       list_add(&p_dev->socket_device_list, &s->devices_list);
 
        spin_unlock_irqrestore(&pcmcia_dev_list_lock, flags);
 
@@ -946,7 +952,7 @@ static ssize_t pcmcia_show_pm_state(struct device *dev, struct device_attribute
 {
        struct pcmcia_device *p_dev = to_pcmcia_dev(dev);
 
-       if (p_dev->dev.power.power_state.event != PM_EVENT_ON)
+       if (p_dev->suspended)
                return sprintf(buf, "off\n");
        else
                return sprintf(buf, "on\n");
@@ -961,11 +967,9 @@ static ssize_t pcmcia_store_pm_state(struct device *dev, struct device_attribute
         if (!count)
                 return -EINVAL;
 
-       if ((p_dev->dev.power.power_state.event == PM_EVENT_ON) &&
-           (!strncmp(buf, "off", 3)))
+       if ((!p_dev->suspended) && !strncmp(buf, "off", 3))
                ret = dpm_runtime_suspend(dev, PMSG_SUSPEND);
-       else if ((p_dev->dev.power.power_state.event != PM_EVENT_ON) &&
-                (!strncmp(buf, "on", 2)))
+       else if (p_dev->suspended && !strncmp(buf, "on", 2))
                dpm_runtime_resume(dev);
 
        return ret ? ret : count;
@@ -1031,22 +1035,27 @@ static int pcmcia_dev_suspend(struct device * dev, pm_message_t state)
 {
        struct pcmcia_device *p_dev = to_pcmcia_dev(dev);
        struct pcmcia_driver *p_drv = NULL;
-       int ret;
+       int ret = 0;
 
        if (dev->driver)
                p_drv = to_pcmcia_drv(dev->driver);
 
-       if (p_drv && p_drv->suspend) {
+       if (!p_drv)
+               goto out;
+
+       if (p_drv->suspend) {
                ret = p_drv->suspend(p_dev);
                if (ret)
-                       return ret;
-               p_dev->state |= DEV_SUSPEND;
-                       if ((p_dev->state & DEV_CONFIG) &&
-                           !(p_dev->state & DEV_SUSPEND_NORELEASE))
-                               pcmcia_release_configuration(p_dev);
+                       goto out;
        }
 
-       return 0;
+       if (p_dev->device_no == p_dev->func)
+               pcmcia_release_configuration(p_dev);
+
+ out:
+       if (!ret)
+               p_dev->suspended = 1;
+       return ret;
 }
 
 
@@ -1054,24 +1063,27 @@ static int pcmcia_dev_resume(struct device * dev)
 {
        struct pcmcia_device *p_dev = to_pcmcia_dev(dev);
         struct pcmcia_driver *p_drv = NULL;
-       int ret;
+       int ret = 0;
 
        if (dev->driver)
                p_drv = to_pcmcia_drv(dev->driver);
 
-       if (p_drv && p_drv->resume) {
-               p_dev->state &= ~DEV_SUSPEND;
-                       if ((p_dev->state & DEV_CONFIG) &&
-                           !(p_dev->state & DEV_SUSPEND_NORELEASE)){
-                               ret = pcmcia_request_configuration(p_dev,
-                                                &p_dev->conf);
-                               if (ret)
-                                       return ret;
-                       }
-               return p_drv->resume(p_dev);
+       if (!p_drv)
+               goto out;
+
+       if (p_dev->device_no == p_dev->func) {
+               ret = pcmcia_request_configuration(p_dev, &p_dev->conf);
+               if (ret)
+                       goto out;
        }
 
-       return 0;
+       if (p_drv->resume)
+               ret = p_drv->resume(p_dev);
+
+ out:
+       if (!ret)
+               p_dev->suspended = 0;
+       return ret;
 }
 
 
@@ -1131,13 +1143,19 @@ static int ds_event(struct pcmcia_socket *skt, event_t event, int priority)
 {
        struct pcmcia_socket *s = pcmcia_get_socket(skt);
 
+       if (!s) {
+               printk(KERN_ERR "PCMCIA obtaining reference to socket %p " \
+                       "failed, event 0x%x lost!\n", skt, event);
+               return -ENODEV;
+       }
+
        ds_dbg(1, "ds_event(0x%06x, %d, 0x%p)\n",
               event, priority, skt);
 
        switch (event) {
        case CS_EVENT_CARD_REMOVAL:
                s->pcmcia_state.present = 0;
-               pcmcia_card_remove(skt);
+               pcmcia_card_remove(skt, NULL);
                handle_event(skt, event);
                break;
 
@@ -1165,6 +1183,32 @@ static int ds_event(struct pcmcia_socket *skt, event_t event, int priority)
 } /* ds_event */
 
 
+struct pcmcia_device * pcmcia_dev_present(struct pcmcia_device *_p_dev)
+{
+       struct pcmcia_device *p_dev;
+       struct pcmcia_device *ret = NULL;
+
+       p_dev = pcmcia_get_dev(_p_dev);
+       if (!p_dev)
+               return NULL;
+
+       if (!p_dev->socket->pcmcia_state.present)
+               goto out;
+
+       if (p_dev->_removed)
+               goto out;
+
+       if (p_dev->suspended)
+               goto out;
+
+       ret = p_dev;
+ out:
+       pcmcia_put_dev(p_dev);
+       return ret;
+}
+EXPORT_SYMBOL(pcmcia_dev_present);
+
+
 static struct pcmcia_callback pcmcia_bus_callback = {
        .owner = THIS_MODULE,
        .event = ds_event,