]> www.pilppa.org Git - linux-2.6-omap-h63xx.git/blobdiff - drivers/char/moxa.c
old buffer overflow in moxa driver
[linux-2.6-omap-h63xx.git] / drivers / char / moxa.c
index 0c34bc5b04e1244178d88fab1772cb712bbb4050..e0d35c20c04fe3d5ceb7030d60077bd6cfdc2152 100644 (file)
@@ -107,7 +107,6 @@ static struct moxa_board_conf {
        int numPorts;
        unsigned long baseAddr;
        int busType;
-       struct pci_dev *pdev;
 
        int loadstat;
 
@@ -146,8 +145,6 @@ struct moxa_port {
        wait_queue_head_t close_wait;
 
        struct timer_list emptyTimer;
-       struct mxser_mstatus GMStatus;
-       struct moxaq_str temp_queue;
 
        char chkPort;
        char lineCtrl;
@@ -277,10 +274,35 @@ static DEFINE_TIMER(moxaTimer, moxa_poll, 0, 0);
 static DEFINE_SPINLOCK(moxa_lock);
 
 #ifdef CONFIG_PCI
-static int moxa_get_PCI_conf(struct pci_dev *p, int board_type,
-               struct moxa_board_conf *board)
+static int __devinit moxa_pci_probe(struct pci_dev *pdev,
+               const struct pci_device_id *ent)
 {
-       board->baseAddr = pci_resource_start (p, 2);
+       struct moxa_board_conf *board;
+       unsigned int i;
+       int board_type = ent->driver_data;
+       int retval;
+
+       retval = pci_enable_device(pdev);
+       if (retval)
+               goto err;
+
+       for (i = 0; i < MAX_BOARDS; i++)
+               if (moxa_boards[i].basemem == NULL)
+                       break;
+
+       retval = -ENODEV;
+       if (i >= MAX_BOARDS) {
+               if (verbose)
+                       printk("More than %d MOXA Intellio family boards "
+                               "found. Board is ignored.\n", MAX_BOARDS);
+               goto err;
+       }
+
+       board = &moxa_boards[i];
+       board->basemem = pci_iomap(pdev, 2, 0x4000);
+       if (board->basemem == NULL)
+               goto err;
+
        board->boardType = board_type;
        switch (board_type) {
        case MOXA_BOARD_C218_ISA:
@@ -296,16 +318,33 @@ static int moxa_get_PCI_conf(struct pci_dev *p, int board_type,
                break;
        }
        board->busType = MOXA_BUS_TYPE_PCI;
-       /* don't lose the reference in the next pci_get_device iteration */
-       board->pdev = pci_dev_get(p);
+
+       pci_set_drvdata(pdev, board);
 
        return (0);
+err:
+       return retval;
+}
+
+static void __devexit moxa_pci_remove(struct pci_dev *pdev)
+{
+       struct moxa_board_conf *brd = pci_get_drvdata(pdev);
+
+       pci_iounmap(pdev, brd->basemem);
+       brd->basemem = NULL;
 }
+
+static struct pci_driver moxa_pci_driver = {
+       .name = "moxa",
+       .id_table = moxa_pcibrds,
+       .probe = moxa_pci_probe,
+       .remove = __devexit_p(moxa_pci_remove)
+};
 #endif /* CONFIG_PCI */
 
 static int __init moxa_init(void)
 {
-       int i, numBoards;
+       int i, numBoards, retval = 0;
        struct moxa_port *ch;
 
        printk(KERN_INFO "MOXA Intellio family driver version %s\n", MOXA_VERSION);
@@ -395,36 +434,22 @@ static int __init moxa_init(void)
                }
        }
 #endif
-       /* Find PCI boards here */
+
 #ifdef CONFIG_PCI
-       {
-               struct pci_dev *p = NULL;
-               int n = ARRAY_SIZE(moxa_pcibrds) - 1;
-               i = 0;
-               while (i < n) {
-                       while ((p = pci_get_device(moxa_pcibrds[i].vendor, moxa_pcibrds[i].device, p))!=NULL)
-                       {
-                               if (pci_enable_device(p))
-                                       continue;
-                               if (numBoards >= MAX_BOARDS) {
-                                       if (verbose)
-                                               printk("More than %d MOXA Intellio family boards found. Board is ignored.", MAX_BOARDS);
-                               } else {
-                                       moxa_get_PCI_conf(p, moxa_pcibrds[i].driver_data,
-                                               &moxa_boards[numBoards]);
-                                       numBoards++;
-                               }
-                       }
-                       i++;
-               }
+       retval = pci_register_driver(&moxa_pci_driver);
+       if (retval) {
+               printk(KERN_ERR "Can't register moxa pci driver!\n");
+               if (numBoards)
+                       retval = 0;
        }
 #endif
+
        for (i = 0; i < numBoards; i++) {
                moxa_boards[i].basemem = ioremap(moxa_boards[i].baseAddr,
                                0x4000);
        }
 
-       return (0);
+       return retval;
 }
 
 static void __exit moxa_exit(void)
@@ -443,12 +468,13 @@ static void __exit moxa_exit(void)
                printk("Couldn't unregister MOXA Intellio family serial driver\n");
        put_tty_driver(moxaDriver);
 
-       for (i = 0; i < MAX_BOARDS; i++) {
+#ifdef CONFIG_PCI
+       pci_unregister_driver(&moxa_pci_driver);
+#endif
+
+       for (i = 0; i < MAX_BOARDS; i++)
                if (moxa_boards[i].basemem)
                        iounmap(moxa_boards[i].basemem);
-               if (moxa_boards[i].busType == MOXA_BUS_TYPE_PCI)
-                       pci_dev_put(moxa_boards[i].pdev);
-       }
 
        if (verbose)
                printk("Done\n");
@@ -1487,17 +1513,15 @@ int MoxaDriverIoctl(unsigned int cmd, unsigned long arg, int port)
                return (0);
        case MOXA_GET_IOQUEUE: {
                struct moxaq_str __user *argm = argp;
-               struct moxa_port *p;
+               struct moxaq_str tmp;
 
                for (i = 0; i < MAX_PORTS; i++, argm++) {
-                       p = &moxa_ports[i];
-                       memset(&p->temp_queue, 0, sizeof(p->temp_queue));
-                       if (p->chkPort) {
-                               p->temp_queue.inq = MoxaPortRxQueue(i);
-                               p->temp_queue.outq = MoxaPortTxQueue(i);
+                       memset(&tmp, 0, sizeof(tmp));
+                       if (moxa_ports[i].chkPort) {
+                               tmp.inq = MoxaPortRxQueue(i);
+                               tmp.outq = MoxaPortTxQueue(i);
                        }
-                       if (copy_to_user(argm, &p->temp_queue,
-                                               sizeof(p->temp_queue)))
+                       if (copy_to_user(argm, &tmp, sizeof(tmp)))
                                return -EFAULT;
                }
                return (0);
@@ -1518,33 +1542,30 @@ int MoxaDriverIoctl(unsigned int cmd, unsigned long arg, int port)
                return 0;
        case MOXA_GETMSTATUS: {
                struct mxser_mstatus __user *argm = argp;
+               struct mxser_mstatus tmp;
                struct moxa_port *p;
 
                for (i = 0; i < MAX_PORTS; i++, argm++) {
                        p = &moxa_ports[i];
-                       p->GMStatus.ri = 0;
-                       p->GMStatus.dcd = 0;
-                       p->GMStatus.dsr = 0;
-                       p->GMStatus.cts = 0;
+                       memset(&tmp, 0, sizeof(tmp));
                        if (!p->chkPort) {
                                goto copy;
                        } else {
                                status = MoxaPortLineStatus(p->port);
                                if (status & 1)
-                                       p->GMStatus.cts = 1;
+                                       tmp.cts = 1;
                                if (status & 2)
-                                       p->GMStatus.dsr = 1;
+                                       tmp.dsr = 1;
                                if (status & 4)
-                                       p->GMStatus.dcd = 1;
+                                       tmp.dcd = 1;
                        }
 
                        if (!p->tty || !p->tty->termios)
-                               p->GMStatus.cflag = p->cflag;
+                               tmp.cflag = p->cflag;
                        else
-                               p->GMStatus.cflag = p->tty->termios->c_cflag;
+                               tmp.cflag = p->tty->termios->c_cflag;
 copy:
-                       if (copy_to_user(argm, &p->GMStatus,
-                                               sizeof(p->GMStatus)))
+                       if (copy_to_user(argm, &tmp, sizeof(tmp)))
                                return -EFAULT;
                }
                return 0;
@@ -1561,7 +1582,7 @@ copy:
 
        if(copy_from_user(&dltmp, argp, sizeof(struct dl_str)))
                return -EFAULT;
-       if(dltmp.cardno < 0 || dltmp.cardno >= MAX_BOARDS)
+       if(dltmp.cardno < 0 || dltmp.cardno >= MAX_BOARDS || dltmp.len < 0)
                return -EINVAL;
 
        switch(cmd)
@@ -2508,6 +2529,8 @@ static int moxaloadbios(int cardno, unsigned char __user *tmp, int len)
        void __iomem *baseAddr;
        int i;
 
+       if(len < 0 || len > sizeof(moxaBuff))
+               return -EINVAL;
        if(copy_from_user(moxaBuff, tmp, len))
                return -EFAULT;
        baseAddr = moxa_boards[cardno].basemem;
@@ -2555,7 +2578,7 @@ static int moxaload320b(int cardno, unsigned char __user *tmp, int len)
        void __iomem *baseAddr;
        int i;
 
-       if(len > sizeof(moxaBuff))
+       if(len < 0 || len > sizeof(moxaBuff))
                return -EINVAL;
        if(copy_from_user(moxaBuff, tmp, len))
                return -EFAULT;
@@ -2575,6 +2598,8 @@ static int moxaloadcode(int cardno, unsigned char __user *tmp, int len)
        void __iomem *baseAddr, *ofsAddr;
        int retval, port, i;
 
+       if(len < 0 || len > sizeof(moxaBuff))
+               return -EINVAL;
        if(copy_from_user(moxaBuff, tmp, len))
                return -EFAULT;
        baseAddr = moxa_boards[cardno].basemem;