1 files changed, 123 insertions, 155 deletions

diff --git a/drivers/firewire/fw-device-cdev.c b/drivers/firewire/fw-device-cdev.c
index fab6dfbcca1b..d2b867f44348 100644
--- a/drivers/firewire/fw-device-cdev.c
+++ b/drivers/firewire/fw-device-cdev.c
@@ -258,41 +258,35 @@ void fw_device_cdev_remove(struct fw_device *device)
         for_each_client(device, wake_up_client);
 }
 
-static int ioctl_get_info(struct client *client, void __user *arg)
+static int ioctl_get_info(struct client *client, void *buffer)
 {
-        struct fw_cdev_get_info get_info;
+        struct fw_cdev_get_info *get_info = buffer;
         struct fw_cdev_event_bus_reset bus_reset;
 
-        if (copy_from_user(&get_info, arg, sizeof get_info))
-                return -EFAULT;
-
-        client->version = get_info.version;
-        get_info.version = FW_CDEV_VERSION;
+        client->version = get_info->version;
+        get_info->version = FW_CDEV_VERSION;
 
-        if (get_info.rom != 0) {
-                void __user *uptr = u64_to_uptr(get_info.rom);
-                size_t want = get_info.rom_length;
+        if (get_info->rom != 0) {
+                void __user *uptr = u64_to_uptr(get_info->rom);
+                size_t want = get_info->rom_length;
                 size_t have = client->device->config_rom_length * 4;
 
                 if (copy_to_user(uptr, client->device->config_rom,
                                  min(want, have)))
                         return -EFAULT;
         }
-        get_info.rom_length = client->device->config_rom_length * 4;
+        get_info->rom_length = client->device->config_rom_length * 4;
 
-        client->bus_reset_closure = get_info.bus_reset_closure;
-        if (get_info.bus_reset != 0) {
-                void __user *uptr = u64_to_uptr(get_info.bus_reset);
+        client->bus_reset_closure = get_info->bus_reset_closure;
+        if (get_info->bus_reset != 0) {
+                void __user *uptr = u64_to_uptr(get_info->bus_reset);
 
                 fill_bus_reset_event(&bus_reset, client);
                 if (copy_to_user(uptr, &bus_reset, sizeof bus_reset))
                         return -EFAULT;
         }
 
-        get_info.card = client->device->card->index;
-
-        if (copy_to_user(arg, &get_info, sizeof get_info))
-                return -EFAULT;
+        get_info->card = client->device->card->index;
 
         return 0;
 }
@@ -369,30 +363,27 @@ complete_transaction(struct fw_card *card, int rcode,
                     response->response.data, response->response.length);
 }
 
-static ssize_t ioctl_send_request(struct client *client, void __user *arg)
+static ssize_t ioctl_send_request(struct client *client, void *buffer)
 {
         struct fw_device *device = client->device;
-        struct fw_cdev_send_request request;
+        struct fw_cdev_send_request *request = buffer;
         struct response *response;
 
-        if (copy_from_user(&request, arg, sizeof request))
-                return -EFAULT;
-
         /* What is the biggest size we'll accept, really? */
-        if (request.length > 4096)
+        if (request->length > 4096)
                 return -EINVAL;
 
-        response = kmalloc(sizeof *response + request.length, GFP_KERNEL);
+        response = kmalloc(sizeof *response + request->length, GFP_KERNEL);
         if (response == NULL)
                 return -ENOMEM;
 
         response->client = client;
-        response->response.length = request.length;
-        response->response.closure = request.closure;
+        response->response.length = request->length;
+        response->response.closure = request->closure;
 
-        if (request.data &&
+        if (request->data &&
             copy_from_user(response->response.data,
-                           u64_to_uptr(request.data), request.length)) {
+                           u64_to_uptr(request->data), request->length)) {
                 kfree(response);
                 return -EFAULT;
         }
@@ -401,16 +392,16 @@ static ssize_t ioctl_send_request(struct client *client, void __user *arg)
         add_client_resource(client, &response->resource);
 
         fw_send_request(device->card, &response->transaction,
-                        request.tcode & 0x1f,
+                        request->tcode & 0x1f,
                         device->node->node_id,
-                        request.generation,
+                        request->generation,
                         device->node->max_speed,
-                        request.offset,
-                        response->response.data, request.length,
+                        request->offset,
+                        response->response.data, request->length,
                         complete_transaction, response);
 
-        if (request.data)
-                return sizeof request + request.length;
+        if (request->data)
+                return sizeof request + request->length;
         else
                 return sizeof request;
 }
@@ -495,25 +486,22 @@ release_address_handler(struct client *client,
         kfree(handler);
 }
 
-static int ioctl_allocate(struct client *client, void __user *arg)
+static int ioctl_allocate(struct client *client, void *buffer)
 {
-        struct fw_cdev_allocate request;
+        struct fw_cdev_allocate *request = buffer;
         struct address_handler *handler;
         struct fw_address_region region;
 
-        if (copy_from_user(&request, arg, sizeof request))
-                return -EFAULT;
-
         handler = kmalloc(sizeof *handler, GFP_KERNEL);
         if (handler == NULL)
                 return -ENOMEM;
 
-        region.start = request.offset;
-        region.end = request.offset + request.length;
-        handler->handler.length = request.length;
+        region.start = request->offset;
+        region.end = request->offset + request->length;
+        handler->handler.length = request->length;
         handler->handler.address_callback = handle_request;
         handler->handler.callback_data = handler;
-        handler->closure = request.closure;
+        handler->closure = request->closure;
         handler->client = client;
 
         if (fw_core_add_address_handler(&handler->handler, &region) < 0) {
@@ -523,55 +511,44 @@ static int ioctl_allocate(struct client *client, void __user *arg)
 
         handler->resource.release = release_address_handler;
         add_client_resource(client, &handler->resource);
-        request.handle = handler->resource.handle;
-
-        if (copy_to_user(arg, &request, sizeof request))
-                return -EFAULT;
+        request->handle = handler->resource.handle;
 
         return 0;
 }
 
-static int ioctl_deallocate(struct client *client, void __user *arg)
+static int ioctl_deallocate(struct client *client, void *buffer)
 {
-        struct fw_cdev_deallocate request;
-
-        if (copy_from_user(&request, arg, sizeof request))
-                return -EFAULT;
+        struct fw_cdev_deallocate *request = buffer;
 
-        return release_client_resource(client, request.handle, NULL);
+        return release_client_resource(client, request->handle, NULL);
 }
 
-static int ioctl_send_response(struct client *client, void __user *arg)
+static int ioctl_send_response(struct client *client, void *buffer)
 {
-        struct fw_cdev_send_response request;
+        struct fw_cdev_send_response *request = buffer;
         struct client_resource *resource;
         struct request *r;
 
-        if (copy_from_user(&request, arg, sizeof request))
-                return -EFAULT;
-        if (release_client_resource(client, request.handle, &resource) < 0)
+        if (release_client_resource(client, request->handle, &resource) < 0)
                 return -EINVAL;
         r = container_of(resource, struct request, resource);
-        if (request.length < r->length)
-                r->length = request.length;
-        if (copy_from_user(r->data, u64_to_uptr(request.data), r->length))
+        if (request->length < r->length)
+                r->length = request->length;
+        if (copy_from_user(r->data, u64_to_uptr(request->data), r->length))
                 return -EFAULT;
 
-        fw_send_response(client->device->card, r->request, request.rcode);
+        fw_send_response(client->device->card, r->request, request->rcode);
         kfree(r);
 
         return 0;
 }
 
-static int ioctl_initiate_bus_reset(struct client *client, void __user *arg)
+static int ioctl_initiate_bus_reset(struct client *client, void *buffer)
 {
-        struct fw_cdev_initiate_bus_reset request;
+        struct fw_cdev_initiate_bus_reset *request = buffer;
         int short_reset;
 
-        if (copy_from_user(&request, arg, sizeof request))
-                return -EFAULT;
-
-        short_reset = (request.type == FW_CDEV_SHORT_RESET);
+        short_reset = (request->type == FW_CDEV_SHORT_RESET);
 
         return fw_core_initiate_bus_reset(client->device->card, short_reset);
 }
@@ -592,32 +569,29 @@ static void release_descriptor(struct client *client,
         kfree(descriptor);
 }
 
-static int ioctl_add_descriptor(struct client *client, void __user *arg)
+static int ioctl_add_descriptor(struct client *client, void *buffer)
 {
-        struct fw_cdev_add_descriptor request;
+        struct fw_cdev_add_descriptor *request = buffer;
         struct descriptor *descriptor;
         int retval;
 
-        if (copy_from_user(&request, arg, sizeof request))
-                return -EFAULT;
-
-        if (request.length > 256)
+        if (request->length > 256)
                 return -EINVAL;
 
         descriptor =
-                kmalloc(sizeof *descriptor + request.length * 4, GFP_KERNEL);
+                kmalloc(sizeof *descriptor + request->length * 4, GFP_KERNEL);
         if (descriptor == NULL)
                 return -ENOMEM;
 
         if (copy_from_user(descriptor->data,
-                           u64_to_uptr(request.data), request.length * 4)) {
+                           u64_to_uptr(request->data), request->length * 4)) {
                 kfree(descriptor);
                 return -EFAULT;
         }
 
-        descriptor->d.length = request.length;
-        descriptor->d.immediate = request.immediate;
-        descriptor->d.key = request.key;
+        descriptor->d.length = request->length;
+        descriptor->d.immediate = request->immediate;
+        descriptor->d.key = request->key;
         descriptor->d.data = descriptor->data;
 
         retval = fw_core_add_descriptor(&descriptor->d);
@@ -628,22 +602,16 @@ static int ioctl_add_descriptor(struct client *client, void __user *arg)
 
         descriptor->resource.release = release_descriptor;
         add_client_resource(client, &descriptor->resource);
-        request.handle = descriptor->resource.handle;
-
-        if (copy_to_user(arg, &request, sizeof request))
-                return -EFAULT;
+        request->handle = descriptor->resource.handle;
 
         return 0;
 }
 
-static int ioctl_remove_descriptor(struct client *client, void __user *arg)
+static int ioctl_remove_descriptor(struct client *client, void *buffer)
 {
-        struct fw_cdev_remove_descriptor request;
+        struct fw_cdev_remove_descriptor *request = buffer;
 
-        if (copy_from_user(&request, arg, sizeof request))
-                return -EFAULT;
-
-        return release_client_resource(client, request.handle, NULL);
+        return release_client_resource(client, request->handle, NULL);
 }
 
 static void
@@ -667,25 +635,22 @@ iso_callback(struct fw_iso_context *context, u32 cycle,
                     sizeof interrupt->interrupt + header_length, NULL, 0);
 }
 
-static int ioctl_create_iso_context(struct client *client, void __user *arg)
+static int ioctl_create_iso_context(struct client *client, void *buffer)
 {
-        struct fw_cdev_create_iso_context request;
+        struct fw_cdev_create_iso_context *request = buffer;
 
-        if (copy_from_user(&request, arg, sizeof request))
-                return -EFAULT;
-
-        if (request.channel > 63)
+        if (request->channel > 63)
                 return -EINVAL;
 
-        switch (request.type) {
+        switch (request->type) {
         case FW_ISO_CONTEXT_RECEIVE:
-                if (request.header_size < 4 || (request.header_size & 3))
+                if (request->header_size < 4 || (request->header_size & 3))
                         return -EINVAL;
 
                 break;
 
         case FW_ISO_CONTEXT_TRANSMIT:
-                if (request.speed > SCODE_3200)
+                if (request->speed > SCODE_3200)
                         return -EINVAL;
 
                 break;
@@ -695,10 +660,10 @@ static int ioctl_create_iso_context(struct client *client, void __user *arg)
         }
 
         client->iso_context = fw_iso_context_create(client->device->card,
-                                                    request.type,
-                                                    request.channel,
-                                                    request.speed,
-                                                    request.header_size,
+                                                    request->type,
+                                                    request->channel,
+                                                    request->speed,
+                                                    request->header_size,
                                                     iso_callback, client);
         if (IS_ERR(client->iso_context))
                 return PTR_ERR(client->iso_context);
@@ -706,9 +671,9 @@ static int ioctl_create_iso_context(struct client *client, void __user *arg)
         return 0;
 }
 
-static int ioctl_queue_iso(struct client *client, void __user *arg)
+static int ioctl_queue_iso(struct client *client, void *buffer)
 {
-        struct fw_cdev_queue_iso request;
+        struct fw_cdev_queue_iso *request = buffer;
         struct fw_cdev_iso_packet __user *p, *end, *next;
         struct fw_iso_context *ctx = client->iso_context;
         unsigned long payload, buffer_end, header_length;
@@ -720,8 +685,6 @@ static int ioctl_queue_iso(struct client *client, void __user *arg)
 
         if (ctx == NULL)
                 return -EINVAL;
-        if (copy_from_user(&request, arg, sizeof request))
-                return -EFAULT;
 
         /* If the user passes a non-NULL data pointer, has mmap()'ed
          * the iso buffer, and the pointer points inside the buffer,
@@ -729,21 +692,21 @@ static int ioctl_queue_iso(struct client *client, void __user *arg)
          * set them both to 0, which will still let packets with
          * payload_length == 0 through.  In other words, if no packets
          * use the indirect payload, the iso buffer need not be mapped
-         * and the request.data pointer is ignored.*/
+         * and the request->data pointer is ignored.*/
 
-        payload = (unsigned long)request.data - client->vm_start;
+        payload = (unsigned long)request->data - client->vm_start;
         buffer_end = client->buffer.page_count << PAGE_SHIFT;
-        if (request.data == 0 || client->buffer.pages == NULL ||
+        if (request->data == 0 || client->buffer.pages == NULL ||
             payload >= buffer_end) {
                 payload = 0;
                 buffer_end = 0;
         }
 
-        if (!access_ok(VERIFY_READ, request.packets, request.size))
+        if (!access_ok(VERIFY_READ, request->packets, request->size))
                 return -EFAULT;
 
-        p = (struct fw_cdev_iso_packet __user *)u64_to_uptr(request.packets);
-        end = (void __user *)p + request.size;
+        p = (struct fw_cdev_iso_packet __user *)u64_to_uptr(request->packets);
+        end = (void __user *)p + request->size;
         count = 0;
         while (p < end) {
                 if (__copy_from_user(&u.packet, p, sizeof *p))
@@ -785,71 +748,76 @@ static int ioctl_queue_iso(struct client *client, void __user *arg)
                 count++;
         }
 
-        request.size    -= uptr_to_u64(p) - request.packets;
-        request.packets  = uptr_to_u64(p);
-        request.data     = client->vm_start + payload;
-
-        if (copy_to_user(arg, &request, sizeof request))
-                return -EFAULT;
+        request->size    -= uptr_to_u64(p) - request->packets;
+        request->packets  = uptr_to_u64(p);
+        request->data     = client->vm_start + payload;
 
         return count;
 }
 
-static int ioctl_start_iso(struct client *client, void __user *arg)
+static int ioctl_start_iso(struct client *client, void *buffer)
 {
-        struct fw_cdev_start_iso request;
-
-        if (copy_from_user(&request, arg, sizeof request))
-                return -EFAULT;
+        struct fw_cdev_start_iso *request = buffer;
 
         if (client->iso_context->type == FW_ISO_CONTEXT_RECEIVE) {
-                if (request.tags == 0 || request.tags > 15)
+                if (request->tags == 0 || request->tags > 15)
                         return -EINVAL;
 
-                if (request.sync > 15)
+                if (request->sync > 15)
                         return -EINVAL;
         }
 
-        return fw_iso_context_start(client->iso_context,
-                                    request.cycle, request.sync, request.tags);
+        return fw_iso_context_start(client->iso_context, request->cycle,
+                                    request->sync, request->tags);
 }
 
-static int ioctl_stop_iso(struct client *client, void __user *arg)
+static int ioctl_stop_iso(struct client *client, void *buffer)
 {
         return fw_iso_context_stop(client->iso_context);
 }
 
+static int (* const ioctl_handlers[])(struct client *client, void *buffer) = {
+        ioctl_get_info,
+        ioctl_send_request,
+        ioctl_allocate,
+        ioctl_deallocate,
+        ioctl_send_response,
+        ioctl_initiate_bus_reset,
+        ioctl_add_descriptor,
+        ioctl_remove_descriptor,
+        ioctl_create_iso_context,
+        ioctl_queue_iso,
+        ioctl_start_iso,
+        ioctl_stop_iso,
+};
+
 static int
 dispatch_ioctl(struct client *client, unsigned int cmd, void __user *arg)
 {
-        switch (cmd) {
-        case FW_CDEV_IOC_GET_INFO:
-                return ioctl_get_info(client, arg);
-        case FW_CDEV_IOC_SEND_REQUEST:
-                return ioctl_send_request(client, arg);
-        case FW_CDEV_IOC_ALLOCATE:
-                return ioctl_allocate(client, arg);
-        case FW_CDEV_IOC_DEALLOCATE:
-                return ioctl_deallocate(client, arg);
-        case FW_CDEV_IOC_SEND_RESPONSE:
-                return ioctl_send_response(client, arg);
-        case FW_CDEV_IOC_INITIATE_BUS_RESET:
-                return ioctl_initiate_bus_reset(client, arg);
-        case FW_CDEV_IOC_ADD_DESCRIPTOR:
-                return ioctl_add_descriptor(client, arg);
-        case FW_CDEV_IOC_REMOVE_DESCRIPTOR:
-                return ioctl_remove_descriptor(client, arg);
-        case FW_CDEV_IOC_CREATE_ISO_CONTEXT:
-                return ioctl_create_iso_context(client, arg);
-        case FW_CDEV_IOC_QUEUE_ISO:
-                return ioctl_queue_iso(client, arg);
-        case FW_CDEV_IOC_START_ISO:
-                return ioctl_start_iso(client, arg);
-        case FW_CDEV_IOC_STOP_ISO:
-                return ioctl_stop_iso(client, arg);
-        default:
+        char buffer[256];
+        int retval;
+
+        if (_IOC_TYPE(cmd) != '#' ||
+            _IOC_NR(cmd) >= ARRAY_SIZE(ioctl_handlers))
                 return -EINVAL;
+
+        if (_IOC_DIR(cmd) & _IOC_WRITE) {
+                if (_IOC_SIZE(cmd) > sizeof buffer ||
+                    copy_from_user(buffer, arg, _IOC_SIZE(cmd)))
+                        return -EFAULT;
+        }
+
+        retval = ioctl_handlers[_IOC_NR(cmd)](client, buffer);
+        if (retval < 0)
+                return retval;
+
+        if (_IOC_DIR(cmd) & _IOC_READ) {
+                if (_IOC_SIZE(cmd) > sizeof buffer ||
+                    copy_to_user(arg, buffer, _IOC_SIZE(cmd)))
+                        return -EFAULT;
         }
+
+        return 0;
 }
 
 static long