From e23ef227d10878ff3f323a1dfed10205a1825b71 Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Sun, 29 May 2011 22:53:12 +0300 Subject: [PATCH 1/4] ptp: Return -EFAULT on copy_to_user() errors copy_to_user() returns the number of bytes remaining, but we want a negative error code in ptp_ioctl. Signed-off-by: Dan Carpenter Acked-by: Richard Cochran Signed-off-by: John Stultz --- drivers/ptp/ptp_chardev.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/ptp/ptp_chardev.c b/drivers/ptp/ptp_chardev.c index a8d03aeb4051..93fa22de5977 100644 --- a/drivers/ptp/ptp_chardev.c +++ b/drivers/ptp/ptp_chardev.c @@ -46,7 +46,8 @@ long ptp_ioctl(struct posix_clock *pc, unsigned int cmd, unsigned long arg) caps.n_ext_ts = ptp->info->n_ext_ts; caps.n_per_out = ptp->info->n_per_out; caps.pps = ptp->info->pps; - err = copy_to_user((void __user *)arg, &caps, sizeof(caps)); + if (copy_to_user((void __user *)arg, &caps, sizeof(caps))) + err = -EFAULT; break; case PTP_EXTTS_REQUEST: From fb5a18cf7c771a12c3f42a5eb4b476eed68b77cb Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Sun, 29 May 2011 22:54:07 +0300 Subject: [PATCH 2/4] ptp: Fix some locking bugs in ptp_read() In ptp_read there is an unlock missing on an error path, and a double unlock on another error path. Signed-off-by: Dan Carpenter Acked-by: Richard Cochran Signed-off-by: John Stultz --- drivers/ptp/ptp_chardev.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/ptp/ptp_chardev.c b/drivers/ptp/ptp_chardev.c index 93fa22de5977..e7f301da2902 100644 --- a/drivers/ptp/ptp_chardev.c +++ b/drivers/ptp/ptp_chardev.c @@ -130,8 +130,10 @@ ssize_t ptp_read(struct posix_clock *pc, return -ERESTARTSYS; } - if (ptp->defunct) + if (ptp->defunct) { + mutex_unlock(&ptp->tsevq_mux); return -ENODEV; + } spin_lock_irqsave(&queue->lock, flags); @@ -151,10 +153,8 @@ ssize_t ptp_read(struct posix_clock *pc, mutex_unlock(&ptp->tsevq_mux); - if (copy_to_user(buf, event, cnt)) { - mutex_unlock(&ptp->tsevq_mux); + if (copy_to_user(buf, event, cnt)) return -EFAULT; - } return cnt; } From e17fd4ba2a81f1d29875b20464e4899185a3c946 Mon Sep 17 00:00:00 2001 From: John Stultz Date: Tue, 31 May 2011 23:26:11 -0700 Subject: [PATCH 3/4] rtc: Fix ioctl error path return Bryan Henderson noticed that the "RTC: Fix rtc driver ioctl specific shortcutting" commit has a small bug: When an ioctl is called with an invalid command code and the clock driver does not have an "ioctl" method, the ioctl returns rc 0 instead of -ENOTTY. This patch fixes the issue. CC: Bryan Henderson CC: Gabor Z. Papp Reported-by: Bryan Henderson Signed-off-by: John Stultz --- drivers/rtc/rtc-dev.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/rtc/rtc-dev.c b/drivers/rtc/rtc-dev.c index d0e06edb14c5..cace6d3aed9a 100644 --- a/drivers/rtc/rtc-dev.c +++ b/drivers/rtc/rtc-dev.c @@ -421,7 +421,8 @@ static long rtc_dev_ioctl(struct file *file, err = ops->ioctl(rtc->dev.parent, cmd, arg); if (err == -ENOIOCTLCMD) err = -ENOTTY; - } + } else + err = -ENOTTY; break; } From d576fe49ca5c238e99d2d010a410480cb2aa29a0 Mon Sep 17 00:00:00 2001 From: Mark Brown Date: Wed, 1 Jun 2011 11:13:16 +0100 Subject: [PATCH 4/4] rtc: Staticize non-exported __rtc_set_alarm() It's not referenced outside this file so there's no need for it to be in the global namespace and sparse warns about that. Signed-off-by: Mark Brown Signed-off-by: John Stultz --- drivers/rtc/interface.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/rtc/interface.c b/drivers/rtc/interface.c index ef6316acec43..df68618f6dbb 100644 --- a/drivers/rtc/interface.c +++ b/drivers/rtc/interface.c @@ -318,7 +318,7 @@ int rtc_read_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm) } EXPORT_SYMBOL_GPL(rtc_read_alarm); -int __rtc_set_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm) +static int __rtc_set_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm) { struct rtc_time tm; long now, scheduled;