[Bluetooth] Add locking for bt_proto array manipulation

[pandora-kernel.git] / net / bluetooth / hidp / sock.c

diff --git a/net/bluetooth/hidp/sock.c b/net/bluetooth/hidp/sock.c
index b8f6776..407fba4 100644 (file)
--- a/net/bluetooth/hidp/sock.c
+++ b/net/bluetooth/hidp/sock.c
@@ -20,7 +20,6 @@
    SOFTWARE IS DISCLAIMED.
 */
 
-#include <linux/config.h>
 #include <linux/module.h>
 
 #include <linux/types.h>
@@ -36,6 +35,7 @@
 #include <linux/ioctl.h>
 #include <linux/file.h>
 #include <linux/init.h>
+#include <linux/compat.h>
 #include <net/sock.h>
 
 #include "hidp.h"
@@ -144,11 +144,88 @@ static int hidp_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long
        return -EINVAL;
 }
 
+#ifdef CONFIG_COMPAT
+struct compat_hidp_connadd_req {
+       int   ctrl_sock;        // Connected control socket
+       int   intr_sock;        // Connteted interrupt socket
+       __u16 parser;
+       __u16 rd_size;
+       compat_uptr_t rd_data;
+       __u8  country;
+       __u8  subclass;
+       __u16 vendor;
+       __u16 product;
+       __u16 version;
+       __u32 flags;
+       __u32 idle_to;
+       char  name[128];
+};
+
+static int hidp_sock_compat_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
+{
+       if (cmd == HIDPGETCONNLIST) {
+               struct hidp_connlist_req cl;
+               uint32_t uci;
+               int err;
+
+               if (get_user(cl.cnum, (uint32_t __user *) arg) ||
+                               get_user(uci, (u32 __user *) (arg + 4)))
+                       return -EFAULT;
+
+               cl.ci = compat_ptr(uci);
+
+               if (cl.cnum <= 0)
+                       return -EINVAL;
+
+               err = hidp_get_connlist(&cl);
+
+               if (!err && put_user(cl.cnum, (uint32_t __user *) arg))
+                       err = -EFAULT;
+
+               return err;
+       } else if (cmd == HIDPCONNADD) {
+               struct compat_hidp_connadd_req ca;
+               struct hidp_connadd_req __user *uca;
+
+               uca = compat_alloc_user_space(sizeof(*uca));
+
+               if (copy_from_user(&ca, (void *) arg, sizeof(ca)))
+                       return -EFAULT;
+
+               if (put_user(ca.ctrl_sock, &uca->ctrl_sock) ||
+                               put_user(ca.intr_sock, &uca->intr_sock) ||
+                               put_user(ca.parser, &uca->parser) ||
+                               put_user(ca.rd_size, &uca->parser) ||
+                               put_user(compat_ptr(ca.rd_data), &uca->rd_data) ||
+                               put_user(ca.country, &uca->country) ||
+                               put_user(ca.subclass, &uca->subclass) ||
+                               put_user(ca.vendor, &uca->vendor) ||
+                               put_user(ca.product, &uca->product) ||
+                               put_user(ca.version, &uca->version) ||
+                               put_user(ca.flags, &uca->flags) ||
+                               put_user(ca.idle_to, &uca->idle_to) ||
+                               copy_to_user(&uca->name[0], &ca.name[0], 128))
+                       return -EFAULT;
+               
+               arg = (unsigned long) uca;
+
+               /* Fall through. We don't actually write back any _changes_
+                  to the structure anyway, so there's no need to copy back
+                  into the original compat version */
+       }
+
+       return hidp_sock_ioctl(sock, cmd, arg);
+}
+#endif
+
 static const struct proto_ops hidp_sock_ops = {
        .family         = PF_BLUETOOTH,
        .owner          = THIS_MODULE,
        .release        = hidp_sock_release,
        .ioctl          = hidp_sock_ioctl,
+#ifdef CONFIG_COMPAT
+       .compat_ioctl   = hidp_sock_compat_ioctl,
+#endif
        .bind           = sock_no_bind,
        .getname        = sock_no_getname,
        .sendmsg        = sock_no_sendmsg,
@@ -179,7 +256,7 @@ static int hidp_sock_create(struct socket *sock, int protocol)
        if (sock->type != SOCK_RAW)
                return -ESOCKTNOSUPPORT;
 
-       sk = sk_alloc(PF_BLUETOOTH, GFP_KERNEL, &hidp_proto, 1);
+       sk = sk_alloc(PF_BLUETOOTH, GFP_ATOMIC, &hidp_proto, 1);
        if (!sk)
                return -ENOMEM;