linux/drivers/isdn/hardware/eicon/diva.c

667 lines
17 KiB
C
Raw Normal View History

License cleanup: add SPDX GPL-2.0 license identifier to files with no license Many source files in the tree are missing licensing information, which makes it harder for compliance tools to determine the correct license. By default all files without license information are under the default license of the kernel, which is GPL version 2. Update the files which contain no license information with the 'GPL-2.0' SPDX license identifier. The SPDX identifier is a legally binding shorthand, which can be used instead of the full boiler plate text. This patch is based on work done by Thomas Gleixner and Kate Stewart and Philippe Ombredanne. How this work was done: Patches were generated and checked against linux-4.14-rc6 for a subset of the use cases: - file had no licensing information it it. - file was a */uapi/* one with no licensing information in it, - file was a */uapi/* one with existing licensing information, Further patches will be generated in subsequent months to fix up cases where non-standard license headers were used, and references to license had to be inferred by heuristics based on keywords. The analysis to determine which SPDX License Identifier to be applied to a file was done in a spreadsheet of side by side results from of the output of two independent scanners (ScanCode & Windriver) producing SPDX tag:value files created by Philippe Ombredanne. Philippe prepared the base worksheet, and did an initial spot review of a few 1000 files. The 4.13 kernel was the starting point of the analysis with 60,537 files assessed. Kate Stewart did a file by file comparison of the scanner results in the spreadsheet to determine which SPDX license identifier(s) to be applied to the file. She confirmed any determination that was not immediately clear with lawyers working with the Linux Foundation. Criteria used to select files for SPDX license identifier tagging was: - Files considered eligible had to be source code files. - Make and config files were included as candidates if they contained >5 lines of source - File already had some variant of a license header in it (even if <5 lines). All documentation files were explicitly excluded. The following heuristics were used to determine which SPDX license identifiers to apply. - when both scanners couldn't find any license traces, file was considered to have no license information in it, and the top level COPYING file license applied. For non */uapi/* files that summary was: SPDX license identifier # files ---------------------------------------------------|------- GPL-2.0 11139 and resulted in the first patch in this series. If that file was a */uapi/* path one, it was "GPL-2.0 WITH Linux-syscall-note" otherwise it was "GPL-2.0". Results of that was: SPDX license identifier # files ---------------------------------------------------|------- GPL-2.0 WITH Linux-syscall-note 930 and resulted in the second patch in this series. - if a file had some form of licensing information in it, and was one of the */uapi/* ones, it was denoted with the Linux-syscall-note if any GPL family license was found in the file or had no licensing in it (per prior point). Results summary: SPDX license identifier # files ---------------------------------------------------|------ GPL-2.0 WITH Linux-syscall-note 270 GPL-2.0+ WITH Linux-syscall-note 169 ((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause) 21 ((GPL-2.0 WITH Linux-syscall-note) OR BSD-3-Clause) 17 LGPL-2.1+ WITH Linux-syscall-note 15 GPL-1.0+ WITH Linux-syscall-note 14 ((GPL-2.0+ WITH Linux-syscall-note) OR BSD-3-Clause) 5 LGPL-2.0+ WITH Linux-syscall-note 4 LGPL-2.1 WITH Linux-syscall-note 3 ((GPL-2.0 WITH Linux-syscall-note) OR MIT) 3 ((GPL-2.0 WITH Linux-syscall-note) AND MIT) 1 and that resulted in the third patch in this series. - when the two scanners agreed on the detected license(s), that became the concluded license(s). - when there was disagreement between the two scanners (one detected a license but the other didn't, or they both detected different licenses) a manual inspection of the file occurred. - In most cases a manual inspection of the information in the file resulted in a clear resolution of the license that should apply (and which scanner probably needed to revisit its heuristics). - When it was not immediately clear, the license identifier was confirmed with lawyers working with the Linux Foundation. - If there was any question as to the appropriate license identifier, the file was flagged for further research and to be revisited later in time. In total, over 70 hours of logged manual review was done on the spreadsheet to determine the SPDX license identifiers to apply to the source files by Kate, Philippe, Thomas and, in some cases, confirmation by lawyers working with the Linux Foundation. Kate also obtained a third independent scan of the 4.13 code base from FOSSology, and compared selected files where the other two scanners disagreed against that SPDX file, to see if there was new insights. The Windriver scanner is based on an older version of FOSSology in part, so they are related. Thomas did random spot checks in about 500 files from the spreadsheets for the uapi headers and agreed with SPDX license identifier in the files he inspected. For the non-uapi files Thomas did random spot checks in about 15000 files. In initial set of patches against 4.14-rc6, 3 files were found to have copy/paste license identifier errors, and have been fixed to reflect the correct identifier. Additionally Philippe spent 10 hours this week doing a detailed manual inspection and review of the 12,461 patched files from the initial patch version early this week with: - a full scancode scan run, collecting the matched texts, detected license ids and scores - reviewing anything where there was a license detected (about 500+ files) to ensure that the applied SPDX license was correct - reviewing anything where there was no detection but the patch license was not GPL-2.0 WITH Linux-syscall-note to ensure that the applied SPDX license was correct This produced a worksheet with 20 files needing minor correction. This worksheet was then exported into 3 different .csv files for the different types of files to be modified. These .csv files were then reviewed by Greg. Thomas wrote a script to parse the csv files and add the proper SPDX tag to the file, in the format that the file expected. This script was further refined by Greg based on the output to detect more types of files automatically and to distinguish between header and source .c files (which need different comment types.) Finally Greg ran the script using the .csv files to generate the patches. Reviewed-by: Kate Stewart <kstewart@linuxfoundation.org> Reviewed-by: Philippe Ombredanne <pombredanne@nexb.com> Reviewed-by: Thomas Gleixner <tglx@linutronix.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-11-01 14:07:57 +00:00
// SPDX-License-Identifier: GPL-2.0
/* $Id: diva.c,v 1.21.4.1 2004/05/08 14:33:43 armin Exp $ */
#define CARDTYPE_H_WANT_DATA 1
#define CARDTYPE_H_WANT_IDI_DATA 0
#define CARDTYPE_H_WANT_RESOURCE_DATA 0
#define CARDTYPE_H_WANT_FILE_DATA 0
#include "platform.h"
#include "debuglib.h"
#include "cardtype.h"
#include "pc.h"
#include "di_defs.h"
#include "di.h"
#include "io.h"
#include "pc_maint.h"
#include "xdi_msg.h"
#include "xdi_adapter.h"
#include "diva_pci.h"
#include "diva.h"
#ifdef CONFIG_ISDN_DIVAS_PRIPCI
#include "os_pri.h"
#endif
#ifdef CONFIG_ISDN_DIVAS_BRIPCI
#include "os_bri.h"
#include "os_4bri.h"
#endif
PISDN_ADAPTER IoAdapters[MAX_ADAPTER];
extern IDI_CALL Requests[MAX_ADAPTER];
extern int create_adapter_proc(diva_os_xdi_adapter_t *a);
extern void remove_adapter_proc(diva_os_xdi_adapter_t *a);
#define DivaIdiReqFunc(N) \
static void DivaIdiRequest##N(ENTITY *e) \
{ if (IoAdapters[N]) (*IoAdapters[N]->DIRequest)(IoAdapters[N], e); }
/*
** Create own 32 Adapters
*/
DivaIdiReqFunc(0)
DivaIdiReqFunc(1)
DivaIdiReqFunc(2)
DivaIdiReqFunc(3)
DivaIdiReqFunc(4)
DivaIdiReqFunc(5)
DivaIdiReqFunc(6)
DivaIdiReqFunc(7)
DivaIdiReqFunc(8)
DivaIdiReqFunc(9)
DivaIdiReqFunc(10)
DivaIdiReqFunc(11)
DivaIdiReqFunc(12)
DivaIdiReqFunc(13)
DivaIdiReqFunc(14)
DivaIdiReqFunc(15)
DivaIdiReqFunc(16)
DivaIdiReqFunc(17)
DivaIdiReqFunc(18)
DivaIdiReqFunc(19)
DivaIdiReqFunc(20)
DivaIdiReqFunc(21)
DivaIdiReqFunc(22)
DivaIdiReqFunc(23)
DivaIdiReqFunc(24)
DivaIdiReqFunc(25)
DivaIdiReqFunc(26)
DivaIdiReqFunc(27)
DivaIdiReqFunc(28)
DivaIdiReqFunc(29)
DivaIdiReqFunc(30)
DivaIdiReqFunc(31)
/*
** LOCALS
*/
static LIST_HEAD(adapter_queue);
typedef struct _diva_get_xlog {
word command;
byte req;
byte rc;
byte data[sizeof(struct mi_pc_maint)];
} diva_get_xlog_t;
typedef struct _diva_supported_cards_info {
int CardOrdinal;
diva_init_card_proc_t init_card;
} diva_supported_cards_info_t;
static diva_supported_cards_info_t divas_supported_cards[] = {
#ifdef CONFIG_ISDN_DIVAS_PRIPCI
/*
PRI Cards
*/
{CARDTYPE_DIVASRV_P_30M_PCI, diva_pri_init_card},
/*
PRI Rev.2 Cards
*/
{CARDTYPE_DIVASRV_P_30M_V2_PCI, diva_pri_init_card},
/*
PRI Rev.2 VoIP Cards
*/
{CARDTYPE_DIVASRV_VOICE_P_30M_V2_PCI, diva_pri_init_card},
#endif
#ifdef CONFIG_ISDN_DIVAS_BRIPCI
/*
4BRI Rev 1 Cards
*/
{CARDTYPE_DIVASRV_Q_8M_PCI, diva_4bri_init_card},
{CARDTYPE_DIVASRV_VOICE_Q_8M_PCI, diva_4bri_init_card},
/*
4BRI Rev 2 Cards
*/
{CARDTYPE_DIVASRV_Q_8M_V2_PCI, diva_4bri_init_card},
{CARDTYPE_DIVASRV_VOICE_Q_8M_V2_PCI, diva_4bri_init_card},
/*
4BRI Based BRI Rev 2 Cards
*/
{CARDTYPE_DIVASRV_B_2M_V2_PCI, diva_4bri_init_card},
{CARDTYPE_DIVASRV_B_2F_PCI, diva_4bri_init_card},
{CARDTYPE_DIVASRV_VOICE_B_2M_V2_PCI, diva_4bri_init_card},
/*
BRI
*/
{CARDTYPE_MAESTRA_PCI, diva_bri_init_card},
#endif
/*
EOL
*/
{-1}
};
static void diva_init_request_array(void);
static void *divas_create_pci_card(int handle, void *pci_dev_handle);
static diva_os_spin_lock_t adapter_lock;
static int diva_find_free_adapters(int base, int nr)
{
int i;
for (i = 0; i < nr; i++) {
if (IoAdapters[base + i]) {
return (-1);
}
}
return (0);
}
static diva_os_xdi_adapter_t *diva_q_get_next(struct list_head *what)
{
diva_os_xdi_adapter_t *a = NULL;
if (what && (what->next != &adapter_queue))
a = list_entry(what->next, diva_os_xdi_adapter_t, link);
return (a);
}
/* --------------------------------------------------------------------------
Add card to the card list
-------------------------------------------------------------------------- */
void *diva_driver_add_card(void *pdev, unsigned long CardOrdinal)
{
diva_os_spin_lock_magic_t old_irql;
diva_os_xdi_adapter_t *pdiva, *pa;
int i, j, max, nr;
for (i = 0; divas_supported_cards[i].CardOrdinal != -1; i++) {
if (divas_supported_cards[i].CardOrdinal == CardOrdinal) {
if (!(pdiva = divas_create_pci_card(i, pdev))) {
return NULL;
}
switch (CardOrdinal) {
case CARDTYPE_DIVASRV_Q_8M_PCI:
case CARDTYPE_DIVASRV_VOICE_Q_8M_PCI:
case CARDTYPE_DIVASRV_Q_8M_V2_PCI:
case CARDTYPE_DIVASRV_VOICE_Q_8M_V2_PCI:
max = MAX_ADAPTER - 4;
nr = 4;
break;
default:
max = MAX_ADAPTER;
nr = 1;
}
diva_os_enter_spin_lock(&adapter_lock, &old_irql, "add card");
for (i = 0; i < max; i++) {
if (!diva_find_free_adapters(i, nr)) {
pdiva->controller = i + 1;
pdiva->xdi_adapter.ANum = pdiva->controller;
IoAdapters[i] = &pdiva->xdi_adapter;
diva_os_leave_spin_lock(&adapter_lock, &old_irql, "add card");
create_adapter_proc(pdiva); /* add adapter to proc file system */
DBG_LOG(("add %s:%d",
CardProperties
[CardOrdinal].Name,
pdiva->controller))
diva_os_enter_spin_lock(&adapter_lock, &old_irql, "add card");
pa = pdiva;
for (j = 1; j < nr; j++) { /* slave adapters, if any */
pa = diva_q_get_next(&pa->link);
if (pa && !pa->interface.cleanup_adapter_proc) {
pa->controller = i + 1 + j;
pa->xdi_adapter.ANum = pa->controller;
IoAdapters[i + j] = &pa->xdi_adapter;
diva_os_leave_spin_lock(&adapter_lock, &old_irql, "add card");
DBG_LOG(("add slave adapter (%d)",
pa->controller))
create_adapter_proc(pa); /* add adapter to proc file system */
diva_os_enter_spin_lock(&adapter_lock, &old_irql, "add card");
} else {
DBG_ERR(("slave adapter problem"))
break;
}
}
diva_os_leave_spin_lock(&adapter_lock, &old_irql, "add card");
return (pdiva);
}
}
diva_os_leave_spin_lock(&adapter_lock, &old_irql, "add card");
/*
Not able to add adapter - remove it and return error
*/
DBG_ERR(("can not alloc request array"))
diva_driver_remove_card(pdiva);
return NULL;
}
}
return NULL;
}
/* --------------------------------------------------------------------------
Called on driver load, MAIN, main, DriverEntry
-------------------------------------------------------------------------- */
int divasa_xdi_driver_entry(void)
{
diva_os_initialize_spin_lock(&adapter_lock, "adapter");
memset(&IoAdapters[0], 0x00, sizeof(IoAdapters));
diva_init_request_array();
return (0);
}
/* --------------------------------------------------------------------------
Remove adapter from list
-------------------------------------------------------------------------- */
static diva_os_xdi_adapter_t *get_and_remove_from_queue(void)
{
diva_os_spin_lock_magic_t old_irql;
diva_os_xdi_adapter_t *a = NULL;
diva_os_enter_spin_lock(&adapter_lock, &old_irql, "driver_unload");
if (!list_empty(&adapter_queue)) {
a = list_entry(adapter_queue.next, diva_os_xdi_adapter_t, link);
list_del(adapter_queue.next);
}
diva_os_leave_spin_lock(&adapter_lock, &old_irql, "driver_unload");
return (a);
}
/* --------------------------------------------------------------------------
Remove card from the card list
-------------------------------------------------------------------------- */
void diva_driver_remove_card(void *pdiva)
{
diva_os_spin_lock_magic_t old_irql;
diva_os_xdi_adapter_t *a[4];
diva_os_xdi_adapter_t *pa;
int i;
pa = a[0] = (diva_os_xdi_adapter_t *) pdiva;
a[1] = a[2] = a[3] = NULL;
diva_os_enter_spin_lock(&adapter_lock, &old_irql, "remode adapter");
for (i = 1; i < 4; i++) {
if ((pa = diva_q_get_next(&pa->link))
&& !pa->interface.cleanup_adapter_proc) {
a[i] = pa;
} else {
break;
}
}
for (i = 0; ((i < 4) && a[i]); i++) {
list_del(&a[i]->link);
}
diva_os_leave_spin_lock(&adapter_lock, &old_irql, "driver_unload");
(*(a[0]->interface.cleanup_adapter_proc)) (a[0]);
for (i = 0; i < 4; i++) {
if (a[i]) {
if (a[i]->controller) {
DBG_LOG(("remove adapter (%d)",
a[i]->controller)) IoAdapters[a[i]->controller - 1] = NULL;
remove_adapter_proc(a[i]);
}
diva_os_free(0, a[i]);
}
}
}
/* --------------------------------------------------------------------------
Create diva PCI adapter and init internal adapter structures
-------------------------------------------------------------------------- */
static void *divas_create_pci_card(int handle, void *pci_dev_handle)
{
diva_supported_cards_info_t *pI = &divas_supported_cards[handle];
diva_os_spin_lock_magic_t old_irql;
diva_os_xdi_adapter_t *a;
DBG_LOG(("found %d-%s", pI->CardOrdinal, CardProperties[pI->CardOrdinal].Name))
if (!(a = (diva_os_xdi_adapter_t *) diva_os_malloc(0, sizeof(*a)))) {
DBG_ERR(("A: can't alloc adapter"));
return NULL;
}
memset(a, 0x00, sizeof(*a));
a->CardIndex = handle;
a->CardOrdinal = pI->CardOrdinal;
a->Bus = DIVAS_XDI_ADAPTER_BUS_PCI;
a->xdi_adapter.cardType = a->CardOrdinal;
a->resources.pci.bus = diva_os_get_pci_bus(pci_dev_handle);
a->resources.pci.func = diva_os_get_pci_func(pci_dev_handle);
a->resources.pci.hdev = pci_dev_handle;
/*
Add master adapter first, so slave adapters will receive higher
numbers as master adapter
*/
diva_os_enter_spin_lock(&adapter_lock, &old_irql, "found_pci_card");
list_add_tail(&a->link, &adapter_queue);
diva_os_leave_spin_lock(&adapter_lock, &old_irql, "found_pci_card");
if ((*(pI->init_card)) (a)) {
diva_os_enter_spin_lock(&adapter_lock, &old_irql, "found_pci_card");
list_del(&a->link);
diva_os_leave_spin_lock(&adapter_lock, &old_irql, "found_pci_card");
diva_os_free(0, a);
DBG_ERR(("A: can't get adapter resources"));
return NULL;
}
return (a);
}
/* --------------------------------------------------------------------------
Called on driver unload FINIT, finit, Unload
-------------------------------------------------------------------------- */
void divasa_xdi_driver_unload(void)
{
diva_os_xdi_adapter_t *a;
while ((a = get_and_remove_from_queue())) {
if (a->interface.cleanup_adapter_proc) {
(*(a->interface.cleanup_adapter_proc)) (a);
}
if (a->controller) {
IoAdapters[a->controller - 1] = NULL;
remove_adapter_proc(a);
}
diva_os_free(0, a);
}
diva_os_destroy_spin_lock(&adapter_lock, "adapter");
}
/*
** Receive and process command from user mode utility
*/
void *diva_xdi_open_adapter(void *os_handle, const void __user *src,
isdn: eicon: fix a missing-check bug In divasmain.c, the function divas_write() firstly invokes the function diva_xdi_open_adapter() to open the adapter that matches with the adapter number provided by the user, and then invokes the function diva_xdi_write() to perform the write operation using the matched adapter. The two functions diva_xdi_open_adapter() and diva_xdi_write() are located in diva.c. In diva_xdi_open_adapter(), the user command is copied to the object 'msg' from the userspace pointer 'src' through the function pointer 'cp_fn', which eventually calls copy_from_user() to do the copy. Then, the adapter number 'msg.adapter' is used to find out a matched adapter from the 'adapter_queue'. A matched adapter will be returned if it is found. Otherwise, NULL is returned to indicate the failure of the verification on the adapter number. As mentioned above, if a matched adapter is returned, the function diva_xdi_write() is invoked to perform the write operation. In this function, the user command is copied once again from the userspace pointer 'src', which is the same as the 'src' pointer in diva_xdi_open_adapter() as both of them are from the 'buf' pointer in divas_write(). Similarly, the copy is achieved through the function pointer 'cp_fn', which finally calls copy_from_user(). After the successful copy, the corresponding command processing handler of the matched adapter is invoked to perform the write operation. It is obvious that there are two copies here from userspace, one is in diva_xdi_open_adapter(), and one is in diva_xdi_write(). Plus, both of these two copies share the same source userspace pointer, i.e., the 'buf' pointer in divas_write(). Given that a malicious userspace process can race to change the content pointed by the 'buf' pointer, this can pose potential security issues. For example, in the first copy, the user provides a valid adapter number to pass the verification process and a valid adapter can be found. Then the user can modify the adapter number to an invalid number. This way, the user can bypass the verification process of the adapter number and inject inconsistent data. This patch reuses the data copied in diva_xdi_open_adapter() and passes it to diva_xdi_write(). This way, the above issues can be avoided. Signed-off-by: Wenwen Wang <wang6495@umn.edu> Signed-off-by: David S. Miller <davem@davemloft.net>
2018-05-21 06:58:07 +00:00
int length, void *mptr,
divas_xdi_copy_from_user_fn_t cp_fn)
{
isdn: eicon: fix a missing-check bug In divasmain.c, the function divas_write() firstly invokes the function diva_xdi_open_adapter() to open the adapter that matches with the adapter number provided by the user, and then invokes the function diva_xdi_write() to perform the write operation using the matched adapter. The two functions diva_xdi_open_adapter() and diva_xdi_write() are located in diva.c. In diva_xdi_open_adapter(), the user command is copied to the object 'msg' from the userspace pointer 'src' through the function pointer 'cp_fn', which eventually calls copy_from_user() to do the copy. Then, the adapter number 'msg.adapter' is used to find out a matched adapter from the 'adapter_queue'. A matched adapter will be returned if it is found. Otherwise, NULL is returned to indicate the failure of the verification on the adapter number. As mentioned above, if a matched adapter is returned, the function diva_xdi_write() is invoked to perform the write operation. In this function, the user command is copied once again from the userspace pointer 'src', which is the same as the 'src' pointer in diva_xdi_open_adapter() as both of them are from the 'buf' pointer in divas_write(). Similarly, the copy is achieved through the function pointer 'cp_fn', which finally calls copy_from_user(). After the successful copy, the corresponding command processing handler of the matched adapter is invoked to perform the write operation. It is obvious that there are two copies here from userspace, one is in diva_xdi_open_adapter(), and one is in diva_xdi_write(). Plus, both of these two copies share the same source userspace pointer, i.e., the 'buf' pointer in divas_write(). Given that a malicious userspace process can race to change the content pointed by the 'buf' pointer, this can pose potential security issues. For example, in the first copy, the user provides a valid adapter number to pass the verification process and a valid adapter can be found. Then the user can modify the adapter number to an invalid number. This way, the user can bypass the verification process of the adapter number and inject inconsistent data. This patch reuses the data copied in diva_xdi_open_adapter() and passes it to diva_xdi_write(). This way, the above issues can be avoided. Signed-off-by: Wenwen Wang <wang6495@umn.edu> Signed-off-by: David S. Miller <davem@davemloft.net>
2018-05-21 06:58:07 +00:00
diva_xdi_um_cfg_cmd_t *msg = (diva_xdi_um_cfg_cmd_t *)mptr;
diva_os_xdi_adapter_t *a = NULL;
diva_os_spin_lock_magic_t old_irql;
struct list_head *tmp;
if (length < sizeof(diva_xdi_um_cfg_cmd_t)) {
DBG_ERR(("A: A(?) open, msg too small (%d < %d)",
length, sizeof(diva_xdi_um_cfg_cmd_t)))
return NULL;
}
isdn: eicon: fix a missing-check bug In divasmain.c, the function divas_write() firstly invokes the function diva_xdi_open_adapter() to open the adapter that matches with the adapter number provided by the user, and then invokes the function diva_xdi_write() to perform the write operation using the matched adapter. The two functions diva_xdi_open_adapter() and diva_xdi_write() are located in diva.c. In diva_xdi_open_adapter(), the user command is copied to the object 'msg' from the userspace pointer 'src' through the function pointer 'cp_fn', which eventually calls copy_from_user() to do the copy. Then, the adapter number 'msg.adapter' is used to find out a matched adapter from the 'adapter_queue'. A matched adapter will be returned if it is found. Otherwise, NULL is returned to indicate the failure of the verification on the adapter number. As mentioned above, if a matched adapter is returned, the function diva_xdi_write() is invoked to perform the write operation. In this function, the user command is copied once again from the userspace pointer 'src', which is the same as the 'src' pointer in diva_xdi_open_adapter() as both of them are from the 'buf' pointer in divas_write(). Similarly, the copy is achieved through the function pointer 'cp_fn', which finally calls copy_from_user(). After the successful copy, the corresponding command processing handler of the matched adapter is invoked to perform the write operation. It is obvious that there are two copies here from userspace, one is in diva_xdi_open_adapter(), and one is in diva_xdi_write(). Plus, both of these two copies share the same source userspace pointer, i.e., the 'buf' pointer in divas_write(). Given that a malicious userspace process can race to change the content pointed by the 'buf' pointer, this can pose potential security issues. For example, in the first copy, the user provides a valid adapter number to pass the verification process and a valid adapter can be found. Then the user can modify the adapter number to an invalid number. This way, the user can bypass the verification process of the adapter number and inject inconsistent data. This patch reuses the data copied in diva_xdi_open_adapter() and passes it to diva_xdi_write(). This way, the above issues can be avoided. Signed-off-by: Wenwen Wang <wang6495@umn.edu> Signed-off-by: David S. Miller <davem@davemloft.net>
2018-05-21 06:58:07 +00:00
if ((*cp_fn) (os_handle, msg, src, sizeof(*msg)) <= 0) {
DBG_ERR(("A: A(?) open, write error"))
return NULL;
}
diva_os_enter_spin_lock(&adapter_lock, &old_irql, "open_adapter");
list_for_each(tmp, &adapter_queue) {
a = list_entry(tmp, diva_os_xdi_adapter_t, link);
isdn: eicon: fix a missing-check bug In divasmain.c, the function divas_write() firstly invokes the function diva_xdi_open_adapter() to open the adapter that matches with the adapter number provided by the user, and then invokes the function diva_xdi_write() to perform the write operation using the matched adapter. The two functions diva_xdi_open_adapter() and diva_xdi_write() are located in diva.c. In diva_xdi_open_adapter(), the user command is copied to the object 'msg' from the userspace pointer 'src' through the function pointer 'cp_fn', which eventually calls copy_from_user() to do the copy. Then, the adapter number 'msg.adapter' is used to find out a matched adapter from the 'adapter_queue'. A matched adapter will be returned if it is found. Otherwise, NULL is returned to indicate the failure of the verification on the adapter number. As mentioned above, if a matched adapter is returned, the function diva_xdi_write() is invoked to perform the write operation. In this function, the user command is copied once again from the userspace pointer 'src', which is the same as the 'src' pointer in diva_xdi_open_adapter() as both of them are from the 'buf' pointer in divas_write(). Similarly, the copy is achieved through the function pointer 'cp_fn', which finally calls copy_from_user(). After the successful copy, the corresponding command processing handler of the matched adapter is invoked to perform the write operation. It is obvious that there are two copies here from userspace, one is in diva_xdi_open_adapter(), and one is in diva_xdi_write(). Plus, both of these two copies share the same source userspace pointer, i.e., the 'buf' pointer in divas_write(). Given that a malicious userspace process can race to change the content pointed by the 'buf' pointer, this can pose potential security issues. For example, in the first copy, the user provides a valid adapter number to pass the verification process and a valid adapter can be found. Then the user can modify the adapter number to an invalid number. This way, the user can bypass the verification process of the adapter number and inject inconsistent data. This patch reuses the data copied in diva_xdi_open_adapter() and passes it to diva_xdi_write(). This way, the above issues can be avoided. Signed-off-by: Wenwen Wang <wang6495@umn.edu> Signed-off-by: David S. Miller <davem@davemloft.net>
2018-05-21 06:58:07 +00:00
if (a->controller == (int)msg->adapter)
break;
a = NULL;
}
diva_os_leave_spin_lock(&adapter_lock, &old_irql, "open_adapter");
if (!a) {
isdn: eicon: fix a missing-check bug In divasmain.c, the function divas_write() firstly invokes the function diva_xdi_open_adapter() to open the adapter that matches with the adapter number provided by the user, and then invokes the function diva_xdi_write() to perform the write operation using the matched adapter. The two functions diva_xdi_open_adapter() and diva_xdi_write() are located in diva.c. In diva_xdi_open_adapter(), the user command is copied to the object 'msg' from the userspace pointer 'src' through the function pointer 'cp_fn', which eventually calls copy_from_user() to do the copy. Then, the adapter number 'msg.adapter' is used to find out a matched adapter from the 'adapter_queue'. A matched adapter will be returned if it is found. Otherwise, NULL is returned to indicate the failure of the verification on the adapter number. As mentioned above, if a matched adapter is returned, the function diva_xdi_write() is invoked to perform the write operation. In this function, the user command is copied once again from the userspace pointer 'src', which is the same as the 'src' pointer in diva_xdi_open_adapter() as both of them are from the 'buf' pointer in divas_write(). Similarly, the copy is achieved through the function pointer 'cp_fn', which finally calls copy_from_user(). After the successful copy, the corresponding command processing handler of the matched adapter is invoked to perform the write operation. It is obvious that there are two copies here from userspace, one is in diva_xdi_open_adapter(), and one is in diva_xdi_write(). Plus, both of these two copies share the same source userspace pointer, i.e., the 'buf' pointer in divas_write(). Given that a malicious userspace process can race to change the content pointed by the 'buf' pointer, this can pose potential security issues. For example, in the first copy, the user provides a valid adapter number to pass the verification process and a valid adapter can be found. Then the user can modify the adapter number to an invalid number. This way, the user can bypass the verification process of the adapter number and inject inconsistent data. This patch reuses the data copied in diva_xdi_open_adapter() and passes it to diva_xdi_write(). This way, the above issues can be avoided. Signed-off-by: Wenwen Wang <wang6495@umn.edu> Signed-off-by: David S. Miller <davem@davemloft.net>
2018-05-21 06:58:07 +00:00
DBG_ERR(("A: A(%d) open, adapter not found", msg->adapter))
}
return (a);
}
/*
** Easy cleanup mailbox status
*/
void diva_xdi_close_adapter(void *adapter, void *os_handle)
{
diva_os_xdi_adapter_t *a = (diva_os_xdi_adapter_t *) adapter;
a->xdi_mbox.status &= ~DIVA_XDI_MBOX_BUSY;
if (a->xdi_mbox.data) {
diva_os_free(0, a->xdi_mbox.data);
a->xdi_mbox.data = NULL;
}
}
int
diva_xdi_write(void *adapter, void *os_handle, const void __user *src,
isdn: eicon: fix a missing-check bug In divasmain.c, the function divas_write() firstly invokes the function diva_xdi_open_adapter() to open the adapter that matches with the adapter number provided by the user, and then invokes the function diva_xdi_write() to perform the write operation using the matched adapter. The two functions diva_xdi_open_adapter() and diva_xdi_write() are located in diva.c. In diva_xdi_open_adapter(), the user command is copied to the object 'msg' from the userspace pointer 'src' through the function pointer 'cp_fn', which eventually calls copy_from_user() to do the copy. Then, the adapter number 'msg.adapter' is used to find out a matched adapter from the 'adapter_queue'. A matched adapter will be returned if it is found. Otherwise, NULL is returned to indicate the failure of the verification on the adapter number. As mentioned above, if a matched adapter is returned, the function diva_xdi_write() is invoked to perform the write operation. In this function, the user command is copied once again from the userspace pointer 'src', which is the same as the 'src' pointer in diva_xdi_open_adapter() as both of them are from the 'buf' pointer in divas_write(). Similarly, the copy is achieved through the function pointer 'cp_fn', which finally calls copy_from_user(). After the successful copy, the corresponding command processing handler of the matched adapter is invoked to perform the write operation. It is obvious that there are two copies here from userspace, one is in diva_xdi_open_adapter(), and one is in diva_xdi_write(). Plus, both of these two copies share the same source userspace pointer, i.e., the 'buf' pointer in divas_write(). Given that a malicious userspace process can race to change the content pointed by the 'buf' pointer, this can pose potential security issues. For example, in the first copy, the user provides a valid adapter number to pass the verification process and a valid adapter can be found. Then the user can modify the adapter number to an invalid number. This way, the user can bypass the verification process of the adapter number and inject inconsistent data. This patch reuses the data copied in diva_xdi_open_adapter() and passes it to diva_xdi_write(). This way, the above issues can be avoided. Signed-off-by: Wenwen Wang <wang6495@umn.edu> Signed-off-by: David S. Miller <davem@davemloft.net>
2018-05-21 06:58:07 +00:00
int length, void *mptr,
divas_xdi_copy_from_user_fn_t cp_fn)
{
isdn: eicon: fix a missing-check bug In divasmain.c, the function divas_write() firstly invokes the function diva_xdi_open_adapter() to open the adapter that matches with the adapter number provided by the user, and then invokes the function diva_xdi_write() to perform the write operation using the matched adapter. The two functions diva_xdi_open_adapter() and diva_xdi_write() are located in diva.c. In diva_xdi_open_adapter(), the user command is copied to the object 'msg' from the userspace pointer 'src' through the function pointer 'cp_fn', which eventually calls copy_from_user() to do the copy. Then, the adapter number 'msg.adapter' is used to find out a matched adapter from the 'adapter_queue'. A matched adapter will be returned if it is found. Otherwise, NULL is returned to indicate the failure of the verification on the adapter number. As mentioned above, if a matched adapter is returned, the function diva_xdi_write() is invoked to perform the write operation. In this function, the user command is copied once again from the userspace pointer 'src', which is the same as the 'src' pointer in diva_xdi_open_adapter() as both of them are from the 'buf' pointer in divas_write(). Similarly, the copy is achieved through the function pointer 'cp_fn', which finally calls copy_from_user(). After the successful copy, the corresponding command processing handler of the matched adapter is invoked to perform the write operation. It is obvious that there are two copies here from userspace, one is in diva_xdi_open_adapter(), and one is in diva_xdi_write(). Plus, both of these two copies share the same source userspace pointer, i.e., the 'buf' pointer in divas_write(). Given that a malicious userspace process can race to change the content pointed by the 'buf' pointer, this can pose potential security issues. For example, in the first copy, the user provides a valid adapter number to pass the verification process and a valid adapter can be found. Then the user can modify the adapter number to an invalid number. This way, the user can bypass the verification process of the adapter number and inject inconsistent data. This patch reuses the data copied in diva_xdi_open_adapter() and passes it to diva_xdi_write(). This way, the above issues can be avoided. Signed-off-by: Wenwen Wang <wang6495@umn.edu> Signed-off-by: David S. Miller <davem@davemloft.net>
2018-05-21 06:58:07 +00:00
diva_xdi_um_cfg_cmd_t *msg = (diva_xdi_um_cfg_cmd_t *)mptr;
diva_os_xdi_adapter_t *a = (diva_os_xdi_adapter_t *) adapter;
void *data;
if (a->xdi_mbox.status & DIVA_XDI_MBOX_BUSY) {
DBG_ERR(("A: A(%d) write, mbox busy", a->controller))
return (-1);
}
if (length < sizeof(diva_xdi_um_cfg_cmd_t)) {
DBG_ERR(("A: A(%d) write, message too small (%d < %d)",
a->controller, length,
sizeof(diva_xdi_um_cfg_cmd_t)))
return (-3);
}
if (!(data = diva_os_malloc(0, length))) {
DBG_ERR(("A: A(%d) write, ENOMEM", a->controller))
return (-2);
}
isdn: eicon: fix a missing-check bug In divasmain.c, the function divas_write() firstly invokes the function diva_xdi_open_adapter() to open the adapter that matches with the adapter number provided by the user, and then invokes the function diva_xdi_write() to perform the write operation using the matched adapter. The two functions diva_xdi_open_adapter() and diva_xdi_write() are located in diva.c. In diva_xdi_open_adapter(), the user command is copied to the object 'msg' from the userspace pointer 'src' through the function pointer 'cp_fn', which eventually calls copy_from_user() to do the copy. Then, the adapter number 'msg.adapter' is used to find out a matched adapter from the 'adapter_queue'. A matched adapter will be returned if it is found. Otherwise, NULL is returned to indicate the failure of the verification on the adapter number. As mentioned above, if a matched adapter is returned, the function diva_xdi_write() is invoked to perform the write operation. In this function, the user command is copied once again from the userspace pointer 'src', which is the same as the 'src' pointer in diva_xdi_open_adapter() as both of them are from the 'buf' pointer in divas_write(). Similarly, the copy is achieved through the function pointer 'cp_fn', which finally calls copy_from_user(). After the successful copy, the corresponding command processing handler of the matched adapter is invoked to perform the write operation. It is obvious that there are two copies here from userspace, one is in diva_xdi_open_adapter(), and one is in diva_xdi_write(). Plus, both of these two copies share the same source userspace pointer, i.e., the 'buf' pointer in divas_write(). Given that a malicious userspace process can race to change the content pointed by the 'buf' pointer, this can pose potential security issues. For example, in the first copy, the user provides a valid adapter number to pass the verification process and a valid adapter can be found. Then the user can modify the adapter number to an invalid number. This way, the user can bypass the verification process of the adapter number and inject inconsistent data. This patch reuses the data copied in diva_xdi_open_adapter() and passes it to diva_xdi_write(). This way, the above issues can be avoided. Signed-off-by: Wenwen Wang <wang6495@umn.edu> Signed-off-by: David S. Miller <davem@davemloft.net>
2018-05-21 06:58:07 +00:00
if (msg) {
*(diva_xdi_um_cfg_cmd_t *)data = *msg;
length = (*cp_fn) (os_handle, (char *)data + sizeof(*msg),
src + sizeof(*msg), length - sizeof(*msg));
} else {
length = (*cp_fn) (os_handle, data, src, length);
}
if (length > 0) {
if ((*(a->interface.cmd_proc))
(a, (diva_xdi_um_cfg_cmd_t *) data, length)) {
length = -3;
}
} else {
DBG_ERR(("A: A(%d) write error (%d)", a->controller,
length))
}
diva_os_free(0, data);
return (length);
}
/*
** Write answers to user mode utility, if any
*/
int
diva_xdi_read(void *adapter, void *os_handle, void __user *dst,
int max_length, divas_xdi_copy_to_user_fn_t cp_fn)
{
diva_os_xdi_adapter_t *a = (diva_os_xdi_adapter_t *) adapter;
int ret;
if (!(a->xdi_mbox.status & DIVA_XDI_MBOX_BUSY)) {
DBG_ERR(("A: A(%d) rx mbox empty", a->controller))
return (-1);
}
if (!a->xdi_mbox.data) {
a->xdi_mbox.status &= ~DIVA_XDI_MBOX_BUSY;
DBG_ERR(("A: A(%d) rx ENOMEM", a->controller))
return (-2);
}
if (max_length < a->xdi_mbox.data_length) {
DBG_ERR(("A: A(%d) rx buffer too short(%d < %d)",
a->controller, max_length,
a->xdi_mbox.data_length))
return (-3);
}
ret = (*cp_fn) (os_handle, dst, a->xdi_mbox.data,
a->xdi_mbox.data_length);
if (ret > 0) {
diva_os_free(0, a->xdi_mbox.data);
a->xdi_mbox.data = NULL;
a->xdi_mbox.status &= ~DIVA_XDI_MBOX_BUSY;
}
return (ret);
}
IRQ: Maintain regs pointer globally rather than passing to IRQ handlers Maintain a per-CPU global "struct pt_regs *" variable which can be used instead of passing regs around manually through all ~1800 interrupt handlers in the Linux kernel. The regs pointer is used in few places, but it potentially costs both stack space and code to pass it around. On the FRV arch, removing the regs parameter from all the genirq function results in a 20% speed up of the IRQ exit path (ie: from leaving timer_interrupt() to leaving do_IRQ()). Where appropriate, an arch may override the generic storage facility and do something different with the variable. On FRV, for instance, the address is maintained in GR28 at all times inside the kernel as part of general exception handling. Having looked over the code, it appears that the parameter may be handed down through up to twenty or so layers of functions. Consider a USB character device attached to a USB hub, attached to a USB controller that posts its interrupts through a cascaded auxiliary interrupt controller. A character device driver may want to pass regs to the sysrq handler through the input layer which adds another few layers of parameter passing. I've build this code with allyesconfig for x86_64 and i386. I've runtested the main part of the code on FRV and i386, though I can't test most of the drivers. I've also done partial conversion for powerpc and MIPS - these at least compile with minimal configurations. This will affect all archs. Mostly the changes should be relatively easy. Take do_IRQ(), store the regs pointer at the beginning, saving the old one: struct pt_regs *old_regs = set_irq_regs(regs); And put the old one back at the end: set_irq_regs(old_regs); Don't pass regs through to generic_handle_irq() or __do_IRQ(). In timer_interrupt(), this sort of change will be necessary: - update_process_times(user_mode(regs)); - profile_tick(CPU_PROFILING, regs); + update_process_times(user_mode(get_irq_regs())); + profile_tick(CPU_PROFILING); I'd like to move update_process_times()'s use of get_irq_regs() into itself, except that i386, alone of the archs, uses something other than user_mode(). Some notes on the interrupt handling in the drivers: (*) input_dev() is now gone entirely. The regs pointer is no longer stored in the input_dev struct. (*) finish_unlinks() in drivers/usb/host/ohci-q.c needs checking. It does something different depending on whether it's been supplied with a regs pointer or not. (*) Various IRQ handler function pointers have been moved to type irq_handler_t. Signed-Off-By: David Howells <dhowells@redhat.com> (cherry picked from 1b16e7ac850969f38b375e511e3fa2f474a33867 commit)
2006-10-05 13:55:46 +00:00
irqreturn_t diva_os_irq_wrapper(int irq, void *context)
{
diva_os_xdi_adapter_t *a = context;
diva_xdi_clear_interrupts_proc_t clear_int_proc;
if (!a || !a->xdi_adapter.diva_isr_handler)
return IRQ_NONE;
if ((clear_int_proc = a->clear_interrupts_proc)) {
(*clear_int_proc) (a);
a->clear_interrupts_proc = NULL;
return IRQ_HANDLED;
}
(*(a->xdi_adapter.diva_isr_handler)) (&a->xdi_adapter);
return IRQ_HANDLED;
}
static void diva_init_request_array(void)
{
Requests[0] = DivaIdiRequest0;
Requests[1] = DivaIdiRequest1;
Requests[2] = DivaIdiRequest2;
Requests[3] = DivaIdiRequest3;
Requests[4] = DivaIdiRequest4;
Requests[5] = DivaIdiRequest5;
Requests[6] = DivaIdiRequest6;
Requests[7] = DivaIdiRequest7;
Requests[8] = DivaIdiRequest8;
Requests[9] = DivaIdiRequest9;
Requests[10] = DivaIdiRequest10;
Requests[11] = DivaIdiRequest11;
Requests[12] = DivaIdiRequest12;
Requests[13] = DivaIdiRequest13;
Requests[14] = DivaIdiRequest14;
Requests[15] = DivaIdiRequest15;
Requests[16] = DivaIdiRequest16;
Requests[17] = DivaIdiRequest17;
Requests[18] = DivaIdiRequest18;
Requests[19] = DivaIdiRequest19;
Requests[20] = DivaIdiRequest20;
Requests[21] = DivaIdiRequest21;
Requests[22] = DivaIdiRequest22;
Requests[23] = DivaIdiRequest23;
Requests[24] = DivaIdiRequest24;
Requests[25] = DivaIdiRequest25;
Requests[26] = DivaIdiRequest26;
Requests[27] = DivaIdiRequest27;
Requests[28] = DivaIdiRequest28;
Requests[29] = DivaIdiRequest29;
Requests[30] = DivaIdiRequest30;
Requests[31] = DivaIdiRequest31;
}
void diva_xdi_display_adapter_features(int card)
{
dword features;
if (!card || ((card - 1) >= MAX_ADAPTER) || !IoAdapters[card - 1]) {
return;
}
card--;
features = IoAdapters[card]->Properties.Features;
DBG_LOG(("FEATURES FOR ADAPTER: %d", card + 1))
DBG_LOG((" DI_FAX3 : %s",
(features & DI_FAX3) ? "Y" : "N"))
DBG_LOG((" DI_MODEM : %s",
(features & DI_MODEM) ? "Y" : "N"))
DBG_LOG((" DI_POST : %s",
(features & DI_POST) ? "Y" : "N"))
DBG_LOG((" DI_V110 : %s",
(features & DI_V110) ? "Y" : "N"))
DBG_LOG((" DI_V120 : %s",
(features & DI_V120) ? "Y" : "N"))
DBG_LOG((" DI_POTS : %s",
(features & DI_POTS) ? "Y" : "N"))
DBG_LOG((" DI_CODEC : %s",
(features & DI_CODEC) ? "Y" : "N"))
DBG_LOG((" DI_MANAGE : %s",
(features & DI_MANAGE) ? "Y" : "N"))
DBG_LOG((" DI_V_42 : %s",
(features & DI_V_42) ? "Y" : "N"))
DBG_LOG((" DI_EXTD_FAX : %s",
(features & DI_EXTD_FAX) ? "Y" : "N"))
DBG_LOG((" DI_AT_PARSER : %s",
(features & DI_AT_PARSER) ? "Y" : "N"))
DBG_LOG((" DI_VOICE_OVER_IP : %s",
(features & DI_VOICE_OVER_IP) ? "Y" : "N"))
}
void diva_add_slave_adapter(diva_os_xdi_adapter_t *a)
{
diva_os_spin_lock_magic_t old_irql;
diva_os_enter_spin_lock(&adapter_lock, &old_irql, "add_slave");
list_add_tail(&a->link, &adapter_queue);
diva_os_leave_spin_lock(&adapter_lock, &old_irql, "add_slave");
}
int diva_card_read_xlog(diva_os_xdi_adapter_t *a)
{
diva_get_xlog_t *req;
byte *data;
if (!a->xdi_adapter.Initialized || !a->xdi_adapter.DIRequest) {
return (-1);
}
if (!(data = diva_os_malloc(0, sizeof(struct mi_pc_maint)))) {
return (-1);
}
memset(data, 0x00, sizeof(struct mi_pc_maint));
if (!(req = diva_os_malloc(0, sizeof(*req)))) {
diva_os_free(0, data);
return (-1);
}
req->command = 0x0400;
req->req = LOG;
req->rc = 0x00;
(*(a->xdi_adapter.DIRequest)) (&a->xdi_adapter, (ENTITY *) req);
if (!req->rc || req->req) {
diva_os_free(0, data);
diva_os_free(0, req);
return (-1);
}
memcpy(data, &req->req, sizeof(struct mi_pc_maint));
diva_os_free(0, req);
a->xdi_mbox.data_length = sizeof(struct mi_pc_maint);
a->xdi_mbox.data = data;
a->xdi_mbox.status = DIVA_XDI_MBOX_BUSY;
return (0);
}
void xdiFreeFile(void *handle)
{
}