Driver core: change add_uevent_var to use a struct

This changes the uevent buffer functions to use a struct instead of a
long list of parameters. It does no longer require the caller to do the
proper buffer termination and size accounting, which is currently wrong
in some places. It fixes a known bug where parts of the uevent
environment are overwritten because of wrong index calculations.

Many thanks to Mathieu Desnoyers for finding bugs and improving the
error handling.

Signed-off-by: Kay Sievers <kay.sievers@vrfy.org>
Cc: Mathieu Desnoyers <mathieu.desnoyers@polymtl.ca>
Cc: Cornelia Huck <cornelia.huck@de.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

5 files changed, 41 insertions, 105 deletions

diff --git a/drivers/base/class.c b/drivers/base/class.c
index 4d2222618b78..ecd6336bffea 100644
--- a/drivers/base/class.c
+++ b/drivers/base/class.c
@@ -180,8 +180,7 @@ static void class_device_create_release(struct class_device *class_dev)
 
 /* needed to allow these devices to have parent class devices */
 static int class_device_create_uevent(struct class_device *class_dev,
-                                       char **envp, int num_envp,
-                                       char *buffer, int buffer_size)
+                                      struct kobj_uevent_env *env)
 {
         pr_debug("%s called for %s\n", __FUNCTION__, class_dev->class_id);
         return 0;
@@ -403,64 +402,43 @@ static void remove_deprecated_class_device_links(struct class_device *cd)
 { }
 #endif
 
-static int class_uevent(struct kset *kset, struct kobject *kobj, char **envp,
-                         int num_envp, char *buffer, int buffer_size)
+static int class_uevent(struct kset *kset, struct kobject *kobj,
+                        struct kobj_uevent_env *env)
 {
         struct class_device *class_dev = to_class_dev(kobj);
         struct device *dev = class_dev->dev;
-        int i = 0;
-        int length = 0;
         int retval = 0;
 
         pr_debug("%s - name = %s\n", __FUNCTION__, class_dev->class_id);
 
         if (MAJOR(class_dev->devt)) {
-                add_uevent_var(envp, num_envp, &i,
-                               buffer, buffer_size, &length,
-                               "MAJOR=%u", MAJOR(class_dev->devt));
+                add_uevent_var(env, "MAJOR=%u", MAJOR(class_dev->devt));
 
-                add_uevent_var(envp, num_envp, &i,
-                               buffer, buffer_size, &length,
-                               "MINOR=%u", MINOR(class_dev->devt));
+                add_uevent_var(env, "MINOR=%u", MINOR(class_dev->devt));
         }
 
         if (dev) {
                 const char *path = kobject_get_path(&dev->kobj, GFP_KERNEL);
                 if (path) {
-                        add_uevent_var(envp, num_envp, &i,
-                                       buffer, buffer_size, &length,
-                                       "PHYSDEVPATH=%s", path);
+                        add_uevent_var(env, "PHYSDEVPATH=%s", path);
                         kfree(path);
                 }
 
                 if (dev->bus)
-                        add_uevent_var(envp, num_envp, &i,
-                                       buffer, buffer_size, &length,
-                                       "PHYSDEVBUS=%s", dev->bus->name);
+                        add_uevent_var(env, "PHYSDEVBUS=%s", dev->bus->name);
 
                 if (dev->driver)
-                        add_uevent_var(envp, num_envp, &i,
-                                       buffer, buffer_size, &length,
-                                       "PHYSDEVDRIVER=%s", dev->driver->name);
+                        add_uevent_var(env, "PHYSDEVDRIVER=%s", dev->driver->name);
         }
 
-        /* terminate, set to next free slot, shrink available space */
-        envp[i] = NULL;
-        envp = &envp[i];
-        num_envp -= i;
-        buffer = &buffer[length];
-        buffer_size -= length;
-
         if (class_dev->uevent) {
                 /* have the class device specific function add its stuff */
-                retval = class_dev->uevent(class_dev, envp, num_envp,
-                                            buffer, buffer_size);
+                retval = class_dev->uevent(class_dev, env);
                 if (retval)
                         pr_debug("class_dev->uevent() returned %d\n", retval);
         } else if (class_dev->class->uevent) {
                 /* have the class specific function add its stuff */
-                retval = class_dev->class->uevent(class_dev, envp, num_envp,
-                                                   buffer, buffer_size);
+                retval = class_dev->class->uevent(class_dev, env);
                 if (retval)
                         pr_debug("class->uevent() returned %d\n", retval);
         }
diff --git a/drivers/base/core.c b/drivers/base/core.c
index ec86d6fc2360..d487c032dc4a 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -141,33 +141,23 @@ static const char *dev_uevent_name(struct kset *kset, struct kobject *kobj)
         return NULL;
 }
 
-static int dev_uevent(struct kset *kset, struct kobject *kobj, char **envp,
-                        int num_envp, char *buffer, int buffer_size)
+static int dev_uevent(struct kset *kset, struct kobject *kobj,
+                      struct kobj_uevent_env *env)
 {
         struct device *dev = to_dev(kobj);
-        int i = 0;
-        int length = 0;
         int retval = 0;
 
         /* add the major/minor if present */
         if (MAJOR(dev->devt)) {
-                add_uevent_var(envp, num_envp, &i,
-                               buffer, buffer_size, &length,
-                               "MAJOR=%u", MAJOR(dev->devt));
-                add_uevent_var(envp, num_envp, &i,
-                               buffer, buffer_size, &length,
-                               "MINOR=%u", MINOR(dev->devt));
+                add_uevent_var(env, "MAJOR=%u", MAJOR(dev->devt));
+                add_uevent_var(env, "MINOR=%u", MINOR(dev->devt));
         }
 
         if (dev->type && dev->type->name)
-                add_uevent_var(envp, num_envp, &i,
-                               buffer, buffer_size, &length,
-                               "DEVTYPE=%s", dev->type->name);
+                add_uevent_var(env, "DEVTYPE=%s", dev->type->name);
 
         if (dev->driver)
-                add_uevent_var(envp, num_envp, &i,
-                               buffer, buffer_size, &length,
-                               "DRIVER=%s", dev->driver->name);
+                add_uevent_var(env, "DRIVER=%s", dev->driver->name);
 
 #ifdef CONFIG_SYSFS_DEPRECATED
         if (dev->class) {
@@ -181,59 +171,43 @@ static int dev_uevent(struct kset *kset, struct kobject *kobj, char **envp,
 
                         path = kobject_get_path(&parent->kobj, GFP_KERNEL);
                         if (path) {
-                                add_uevent_var(envp, num_envp, &i,
-                                               buffer, buffer_size, &length,
-                                               "PHYSDEVPATH=%s", path);
+                                add_uevent_var(env, "PHYSDEVPATH=%s", path);
                                 kfree(path);
                         }
 
-                        add_uevent_var(envp, num_envp, &i,
-                                       buffer, buffer_size, &length,
-                                       "PHYSDEVBUS=%s", parent->bus->name);
+                        add_uevent_var(env, "PHYSDEVBUS=%s", parent->bus->name);
 
                         if (parent->driver)
-                                add_uevent_var(envp, num_envp, &i,
-                                               buffer, buffer_size, &length,
-                                               "PHYSDEVDRIVER=%s", parent->driver->name);
+                                add_uevent_var(env, "PHYSDEVDRIVER=%s",
+                                               parent->driver->name);
                 }
         } else if (dev->bus) {
-                add_uevent_var(envp, num_envp, &i,
-                               buffer, buffer_size, &length,
-                               "PHYSDEVBUS=%s", dev->bus->name);
+                add_uevent_var(env, "PHYSDEVBUS=%s", dev->bus->name);
 
                 if (dev->driver)
-                        add_uevent_var(envp, num_envp, &i,
-                                       buffer, buffer_size, &length,
-                                       "PHYSDEVDRIVER=%s", dev->driver->name);
+                        add_uevent_var(env, "PHYSDEVDRIVER=%s", dev->driver->name);
         }
 #endif
 
-        /* terminate, set to next free slot, shrink available space */
-        envp[i] = NULL;
-        envp = &envp[i];
-        num_envp -= i;
-        buffer = &buffer[length];
-        buffer_size -= length;
-
+        /* have the bus specific function add its stuff */
         if (dev->bus && dev->bus->uevent) {
-                /* have the bus specific function add its stuff */
-                retval = dev->bus->uevent(dev, envp, num_envp, buffer, buffer_size);
+                retval = dev->bus->uevent(dev, env);
                 if (retval)
                         pr_debug ("%s: bus uevent() returned %d\n",
                                   __FUNCTION__, retval);
         }
 
+        /* have the class specific function add its stuff */
         if (dev->class && dev->class->dev_uevent) {
-                /* have the class specific function add its stuff */
-                retval = dev->class->dev_uevent(dev, envp, num_envp, buffer, buffer_size);
+                retval = dev->class->dev_uevent(dev, env);
                 if (retval)
                         pr_debug("%s: class uevent() returned %d\n",
                                  __FUNCTION__, retval);
         }
 
+        /* have the device type specific fuction add its stuff */
         if (dev->type && dev->type->uevent) {
-                /* have the device type specific fuction add its stuff */
-                retval = dev->type->uevent(dev, envp, num_envp, buffer, buffer_size);
+                retval = dev->type->uevent(dev, env);
                 if (retval)
                         pr_debug("%s: dev_type uevent() returned %d\n",
                                  __FUNCTION__, retval);
@@ -253,9 +227,7 @@ static ssize_t show_uevent(struct device *dev, struct device_attribute *attr,
 {
         struct kobject *top_kobj;
         struct kset *kset;
-        char *envp[32];
-        char *data = NULL;
-        char *pos;
+        struct kobj_uevent_env *env = NULL;
         int i;
         size_t count = 0;
         int retval;
@@ -278,26 +250,20 @@ static ssize_t show_uevent(struct device *dev, struct device_attribute *attr,
                 if (!kset->uevent_ops->filter(kset, &dev->kobj))
                         goto out;
 
-        data = (char *)get_zeroed_page(GFP_KERNEL);
-        if (!data)
+        env = kzalloc(sizeof(struct kobj_uevent_env), GFP_KERNEL);
+        if (!env)
                 return -ENOMEM;
 
         /* let the kset specific function add its keys */
-        pos = data;
-        memset(envp, 0, sizeof(envp));
-        retval = kset->uevent_ops->uevent(kset, &dev->kobj,
-                                          envp, ARRAY_SIZE(envp),
-                                          pos, PAGE_SIZE);
+        retval = kset->uevent_ops->uevent(kset, &dev->kobj, env);
         if (retval)
                 goto out;
 
         /* copy keys to file */
-        for (i = 0; envp[i]; i++) {
-                pos = &buf[count];
-                count += sprintf(pos, "%s\n", envp[i]);
-        }
+        for (i = 0; i < env->envp_idx; i++)
+                count += sprintf(&buf[count], "%s\n", env->envp[i]);
 out:
-        free_page((unsigned long)data);
+        kfree(env);
         return count;
 }
 
diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c
index b24efd4e3e3d..4a1b9bfc5471 100644
--- a/drivers/base/firmware_class.c
+++ b/drivers/base/firmware_class.c
@@ -88,19 +88,14 @@ static CLASS_ATTR(timeout, 0644, firmware_timeout_show, firmware_timeout_store);
 
 static void fw_dev_release(struct device *dev);
 
-static int firmware_uevent(struct device *dev, char **envp, int num_envp,
-                           char *buffer, int buffer_size)
+static int firmware_uevent(struct device *dev, struct kobj_uevent_env *env)
 {
         struct firmware_priv *fw_priv = dev_get_drvdata(dev);
-        int i = 0, len = 0;
 
-        if (add_uevent_var(envp, num_envp, &i, buffer, buffer_size, &len,
-                           "FIRMWARE=%s", fw_priv->fw_id))
+        if (add_uevent_var(env, "FIRMWARE=%s", fw_priv->fw_id))
                 return -ENOMEM;
-        if (add_uevent_var(envp, num_envp, &i, buffer, buffer_size, &len,
-                           "TIMEOUT=%i", loading_timeout))
+        if (add_uevent_var(env, "TIMEOUT=%i", loading_timeout))
                 return -ENOMEM;
-        envp[i] = NULL;
 
         return 0;
 }
diff --git a/drivers/base/memory.c b/drivers/base/memory.c
index 74b96795d2f5..cb99daeae936 100644
--- a/drivers/base/memory.c
+++ b/drivers/base/memory.c
@@ -34,8 +34,7 @@ static const char *memory_uevent_name(struct kset *kset, struct kobject *kobj)
         return MEMORY_CLASS_NAME;
 }
 
-static int memory_uevent(struct kset *kset, struct kobject *kobj, char **envp,
-                        int num_envp, char *buffer, int buffer_size)
+static int memory_uevent(struct kset *kset, struct kobj_uevent_env *env)
 {
         int retval = 0;
 
diff --git a/drivers/base/platform.c b/drivers/base/platform.c
index 9bfc434d1327..a2e3910196e0 100644
--- a/drivers/base/platform.c
+++ b/drivers/base/platform.c
@@ -529,13 +529,11 @@ static struct device_attribute platform_dev_attrs[] = {
         __ATTR_NULL,
 };
 
-static int platform_uevent(struct device *dev, char **envp, int num_envp,
-                char *buffer, int buffer_size)
+static int platform_uevent(struct device *dev, struct kobj_uevent_env *env)
 {
         struct platform_device  *pdev = to_platform_device(dev);
 
-        envp[0] = buffer;
-        snprintf(buffer, buffer_size, "MODALIAS=platform:%s", pdev->name);
+        add_uevent_var(env, "MODALIAS=platform:%s", pdev->name);
         return 0;
 }