Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

[pandora-kernel.git] / drivers / input / joydev.c

diff --git a/drivers/input/joydev.c b/drivers/input/joydev.c
index 012a5e7..9a1d55b 100644 (file)
--- a/drivers/input/joydev.c
+++ b/drivers/input/joydev.c
@@ -39,7 +39,6 @@ struct joydev {
        int exist;
        int open;
        int minor;
-       char name[16];
        struct input_handle handle;
        wait_queue_head_t wait;
        struct list_head client_list;
@@ -457,8 +456,11 @@ static int joydev_ioctl_common(struct joydev *joydev,
                                unsigned int cmd, void __user *argp)
 {
        struct input_dev *dev = joydev->handle.dev;
+       size_t len;
        int i, j;
+       const char *name;
 
+       /* Process fixed-sized commands. */
        switch (cmd) {
 
        case JS_SET_CAL:
@@ -500,9 +502,22 @@ static int joydev_ioctl_common(struct joydev *joydev,
                return copy_to_user(argp, joydev->corr,
                        sizeof(joydev->corr[0]) * joydev->nabs) ? -EFAULT : 0;
 
-       case JSIOCSAXMAP:
-               if (copy_from_user(joydev->abspam, argp,
-                                  sizeof(__u8) * (ABS_MAX + 1)))
+       }
+
+       /*
+        * Process variable-sized commands (the axis and button map commands
+        * are considered variable-sized to decouple them from the values of
+        * ABS_MAX and KEY_MAX).
+        */
+       switch (cmd & ~IOCSIZE_MASK) {
+
+       case (JSIOCSAXMAP & ~IOCSIZE_MASK):
+               len = min_t(size_t, _IOC_SIZE(cmd), sizeof(joydev->abspam));
+               /*
+                * FIXME: we should not copy into our axis map before
+                * validating the data.
+                */
+               if (copy_from_user(joydev->abspam, argp, len))
                        return -EFAULT;
 
                for (i = 0; i < joydev->nabs; i++) {
@@ -512,13 +527,17 @@ static int joydev_ioctl_common(struct joydev *joydev,
                }
                return 0;
 
-       case JSIOCGAXMAP:
-               return copy_to_user(argp, joydev->abspam,
-                       sizeof(__u8) * (ABS_MAX + 1)) ? -EFAULT : 0;
-
-       case JSIOCSBTNMAP:
-               if (copy_from_user(joydev->keypam, argp,
-                                  sizeof(__u16) * (KEY_MAX - BTN_MISC + 1)))
+       case (JSIOCGAXMAP & ~IOCSIZE_MASK):
+               len = min_t(size_t, _IOC_SIZE(cmd), sizeof(joydev->abspam));
+               return copy_to_user(argp, joydev->abspam, len) ? -EFAULT : 0;
+
+       case (JSIOCSBTNMAP & ~IOCSIZE_MASK):
+               len = min_t(size_t, _IOC_SIZE(cmd), sizeof(joydev->keypam));
+               /*
+                * FIXME: we should not copy into our keymap before
+                * validating the data.
+                */
+               if (copy_from_user(joydev->keypam, argp, len))
                        return -EFAULT;
 
                for (i = 0; i < joydev->nkey; i++) {
@@ -530,23 +549,19 @@ static int joydev_ioctl_common(struct joydev *joydev,
 
                return 0;
 
-       case JSIOCGBTNMAP:
-               return copy_to_user(argp, joydev->keypam,
-                       sizeof(__u16) * (KEY_MAX - BTN_MISC + 1)) ? -EFAULT : 0;
+       case (JSIOCGBTNMAP & ~IOCSIZE_MASK):
+               len = min_t(size_t, _IOC_SIZE(cmd), sizeof(joydev->keypam));
+               return copy_to_user(argp, joydev->keypam, len) ? -EFAULT : 0;
 
-       default:
-               if ((cmd & ~IOCSIZE_MASK) == JSIOCGNAME(0)) {
-                       int len;
-                       if (!dev->name)
-                               return 0;
-                       len = strlen(dev->name) + 1;
-                       if (len > _IOC_SIZE(cmd))
-                               len = _IOC_SIZE(cmd);
-                       if (copy_to_user(argp, dev->name, len))
-                               return -EFAULT;
-                       return len;
-               }
+       case JSIOCGNAME(0):
+               name = dev->name;
+               if (!name)
+                       return 0;
+
+               len = min_t(size_t, _IOC_SIZE(cmd), strlen(name) + 1);
+               return copy_to_user(argp, name, len) ? -EFAULT : len;
        }
+
        return -EINVAL;
 }
 
@@ -742,13 +757,13 @@ static int joydev_connect(struct input_handler *handler, struct input_dev *dev,
        mutex_init(&joydev->mutex);
        init_waitqueue_head(&joydev->wait);
 
-       snprintf(joydev->name, sizeof(joydev->name), "js%d", minor);
+       dev_set_name(&joydev->dev, "js%d", minor);
        joydev->exist = 1;
        joydev->minor = minor;
 
        joydev->exist = 1;
        joydev->handle.dev = input_get_device(dev);
-       joydev->handle.name = joydev->name;
+       joydev->handle.name = dev_name(&joydev->dev);
        joydev->handle.handler = handler;
        joydev->handle.private = joydev;
 
@@ -797,7 +812,6 @@ static int joydev_connect(struct input_handler *handler, struct input_dev *dev,
                }
        }
 
-       dev_set_name(&joydev->dev, joydev->name);
        joydev->dev.devt = MKDEV(INPUT_MAJOR, JOYDEV_MINOR_BASE + minor);
        joydev->dev.class = &input_class;
        joydev->dev.parent = &dev->dev;