drivers/char: Eliminate use after free
[pandora-kernel.git] / drivers / char / raw.c
1 /*
2  * linux/drivers/char/raw.c
3  *
4  * Front-end raw character devices.  These can be bound to any block
5  * devices to provide genuine Unix raw character device semantics.
6  *
7  * We reserve minor number 0 for a control interface.  ioctl()s on this
8  * device are used to bind the other minor numbers to block devices.
9  */
10
11 #include <linux/init.h>
12 #include <linux/fs.h>
13 #include <linux/major.h>
14 #include <linux/blkdev.h>
15 #include <linux/module.h>
16 #include <linux/raw.h>
17 #include <linux/capability.h>
18 #include <linux/uio.h>
19 #include <linux/cdev.h>
20 #include <linux/device.h>
21 #include <linux/mutex.h>
22 #include <linux/smp_lock.h>
23 #include <linux/gfp.h>
24
25 #include <asm/uaccess.h>
26
27 struct raw_device_data {
28         struct block_device *binding;
29         int inuse;
30 };
31
32 static struct class *raw_class;
33 static struct raw_device_data raw_devices[MAX_RAW_MINORS];
34 static DEFINE_MUTEX(raw_mutex);
35 static const struct file_operations raw_ctl_fops; /* forward declaration */
36
37 /*
38  * Open/close code for raw IO.
39  *
40  * We just rewrite the i_mapping for the /dev/raw/rawN file descriptor to
41  * point at the blockdev's address_space and set the file handle to use
42  * O_DIRECT.
43  *
44  * Set the device's soft blocksize to the minimum possible.  This gives the
45  * finest possible alignment and has no adverse impact on performance.
46  */
47 static int raw_open(struct inode *inode, struct file *filp)
48 {
49         const int minor = iminor(inode);
50         struct block_device *bdev;
51         int err;
52
53         if (minor == 0) {       /* It is the control device */
54                 filp->f_op = &raw_ctl_fops;
55                 return 0;
56         }
57
58         lock_kernel();
59         mutex_lock(&raw_mutex);
60
61         /*
62          * All we need to do on open is check that the device is bound.
63          */
64         bdev = raw_devices[minor].binding;
65         err = -ENODEV;
66         if (!bdev)
67                 goto out;
68         igrab(bdev->bd_inode);
69         err = blkdev_get(bdev, filp->f_mode);
70         if (err)
71                 goto out;
72         err = bd_claim(bdev, raw_open);
73         if (err)
74                 goto out1;
75         err = set_blocksize(bdev, bdev_logical_block_size(bdev));
76         if (err)
77                 goto out2;
78         filp->f_flags |= O_DIRECT;
79         filp->f_mapping = bdev->bd_inode->i_mapping;
80         if (++raw_devices[minor].inuse == 1)
81                 filp->f_path.dentry->d_inode->i_mapping =
82                         bdev->bd_inode->i_mapping;
83         filp->private_data = bdev;
84         mutex_unlock(&raw_mutex);
85         unlock_kernel();
86         return 0;
87
88 out2:
89         bd_release(bdev);
90 out1:
91         blkdev_put(bdev, filp->f_mode);
92 out:
93         mutex_unlock(&raw_mutex);
94         unlock_kernel();
95         return err;
96 }
97
98 /*
99  * When the final fd which refers to this character-special node is closed, we
100  * make its ->mapping point back at its own i_data.
101  */
102 static int raw_release(struct inode *inode, struct file *filp)
103 {
104         const int minor= iminor(inode);
105         struct block_device *bdev;
106
107         mutex_lock(&raw_mutex);
108         bdev = raw_devices[minor].binding;
109         if (--raw_devices[minor].inuse == 0) {
110                 /* Here  inode->i_mapping == bdev->bd_inode->i_mapping  */
111                 inode->i_mapping = &inode->i_data;
112                 inode->i_mapping->backing_dev_info = &default_backing_dev_info;
113         }
114         mutex_unlock(&raw_mutex);
115
116         bd_release(bdev);
117         blkdev_put(bdev, filp->f_mode);
118         return 0;
119 }
120
121 /*
122  * Forward ioctls to the underlying block device.
123  */
124 static int
125 raw_ioctl(struct inode *inode, struct file *filp,
126                   unsigned int command, unsigned long arg)
127 {
128         struct block_device *bdev = filp->private_data;
129
130         return blkdev_ioctl(bdev, 0, command, arg);
131 }
132
133 static void bind_device(struct raw_config_request *rq)
134 {
135         device_destroy(raw_class, MKDEV(RAW_MAJOR, rq->raw_minor));
136         device_create(raw_class, NULL, MKDEV(RAW_MAJOR, rq->raw_minor), NULL,
137                       "raw%d", rq->raw_minor);
138 }
139
140 /*
141  * Deal with ioctls against the raw-device control interface, to bind
142  * and unbind other raw devices.
143  */
144 static int raw_ctl_ioctl(struct inode *inode, struct file *filp,
145                         unsigned int command, unsigned long arg)
146 {
147         struct raw_config_request rq;
148         struct raw_device_data *rawdev;
149         int err = 0;
150
151         switch (command) {
152         case RAW_SETBIND:
153         case RAW_GETBIND:
154
155                 /* First, find out which raw minor we want */
156
157                 if (copy_from_user(&rq, (void __user *) arg, sizeof(rq))) {
158                         err = -EFAULT;
159                         goto out;
160                 }
161
162                 if (rq.raw_minor <= 0 || rq.raw_minor >= MAX_RAW_MINORS) {
163                         err = -EINVAL;
164                         goto out;
165                 }
166                 rawdev = &raw_devices[rq.raw_minor];
167
168                 if (command == RAW_SETBIND) {
169                         dev_t dev;
170
171                         /*
172                          * This is like making block devices, so demand the
173                          * same capability
174                          */
175                         if (!capable(CAP_SYS_ADMIN)) {
176                                 err = -EPERM;
177                                 goto out;
178                         }
179
180                         /*
181                          * For now, we don't need to check that the underlying
182                          * block device is present or not: we can do that when
183                          * the raw device is opened.  Just check that the
184                          * major/minor numbers make sense.
185                          */
186
187                         dev = MKDEV(rq.block_major, rq.block_minor);
188                         if ((rq.block_major == 0 && rq.block_minor != 0) ||
189                                         MAJOR(dev) != rq.block_major ||
190                                         MINOR(dev) != rq.block_minor) {
191                                 err = -EINVAL;
192                                 goto out;
193                         }
194
195                         mutex_lock(&raw_mutex);
196                         if (rawdev->inuse) {
197                                 mutex_unlock(&raw_mutex);
198                                 err = -EBUSY;
199                                 goto out;
200                         }
201                         if (rawdev->binding) {
202                                 bdput(rawdev->binding);
203                                 module_put(THIS_MODULE);
204                         }
205                         if (rq.block_major == 0 && rq.block_minor == 0) {
206                                 /* unbind */
207                                 rawdev->binding = NULL;
208                                 device_destroy(raw_class,
209                                                 MKDEV(RAW_MAJOR, rq.raw_minor));
210                         } else {
211                                 rawdev->binding = bdget(dev);
212                                 if (rawdev->binding == NULL)
213                                         err = -ENOMEM;
214                                 else {
215                                         __module_get(THIS_MODULE);
216                                         bind_device(&rq);
217                                 }
218                         }
219                         mutex_unlock(&raw_mutex);
220                 } else {
221                         struct block_device *bdev;
222
223                         mutex_lock(&raw_mutex);
224                         bdev = rawdev->binding;
225                         if (bdev) {
226                                 rq.block_major = MAJOR(bdev->bd_dev);
227                                 rq.block_minor = MINOR(bdev->bd_dev);
228                         } else {
229                                 rq.block_major = rq.block_minor = 0;
230                         }
231                         mutex_unlock(&raw_mutex);
232                         if (copy_to_user((void __user *)arg, &rq, sizeof(rq))) {
233                                 err = -EFAULT;
234                                 goto out;
235                         }
236                 }
237                 break;
238         default:
239                 err = -EINVAL;
240                 break;
241         }
242 out:
243         return err;
244 }
245
246 static const struct file_operations raw_fops = {
247         .read   =       do_sync_read,
248         .aio_read =     generic_file_aio_read,
249         .write  =       do_sync_write,
250         .aio_write =    blkdev_aio_write,
251         .fsync  =       blkdev_fsync,
252         .open   =       raw_open,
253         .release=       raw_release,
254         .ioctl  =       raw_ioctl,
255         .owner  =       THIS_MODULE,
256 };
257
258 static const struct file_operations raw_ctl_fops = {
259         .ioctl  =       raw_ctl_ioctl,
260         .open   =       raw_open,
261         .owner  =       THIS_MODULE,
262 };
263
264 static struct cdev raw_cdev;
265
266 static char *raw_devnode(struct device *dev, mode_t *mode)
267 {
268         return kasprintf(GFP_KERNEL, "raw/%s", dev_name(dev));
269 }
270
271 static int __init raw_init(void)
272 {
273         dev_t dev = MKDEV(RAW_MAJOR, 0);
274         int ret;
275
276         ret = register_chrdev_region(dev, MAX_RAW_MINORS, "raw");
277         if (ret)
278                 goto error;
279
280         cdev_init(&raw_cdev, &raw_fops);
281         ret = cdev_add(&raw_cdev, dev, MAX_RAW_MINORS);
282         if (ret) {
283                 kobject_put(&raw_cdev.kobj);
284                 goto error_region;
285         }
286
287         raw_class = class_create(THIS_MODULE, "raw");
288         if (IS_ERR(raw_class)) {
289                 printk(KERN_ERR "Error creating raw class.\n");
290                 cdev_del(&raw_cdev);
291                 ret = PTR_ERR(raw_class);
292                 goto error_region;
293         }
294         raw_class->devnode = raw_devnode;
295         device_create(raw_class, NULL, MKDEV(RAW_MAJOR, 0), NULL, "rawctl");
296
297         return 0;
298
299 error_region:
300         unregister_chrdev_region(dev, MAX_RAW_MINORS);
301 error:
302         return ret;
303 }
304
305 static void __exit raw_exit(void)
306 {
307         device_destroy(raw_class, MKDEV(RAW_MAJOR, 0));
308         class_destroy(raw_class);
309         cdev_del(&raw_cdev);
310         unregister_chrdev_region(MKDEV(RAW_MAJOR, 0), MAX_RAW_MINORS);
311 }
312
313 module_init(raw_init);
314 module_exit(raw_exit);
315 MODULE_LICENSE("GPL");