1 files changed, 83 insertions, 5 deletions

diff --git a/fs/char_dev.c b/fs/char_dev.c
index 0009346d827f..a885f46ca001 100644
--- a/fs/char_dev.c
+++ b/fs/char_dev.c
@@ -24,6 +24,7 @@
 #ifdef CONFIG_KMOD
 #include <linux/kmod.h>
 #endif
+#include "internal.h"
 
 /*
  * capabilities for /dev/mem, /dev/kmem and similar directly mappable character
@@ -128,13 +129,31 @@ __register_chrdev_region(unsigned int major, unsigned int baseminor,
 
         for (cp = &chrdevs[i]; *cp; cp = &(*cp)->next)
                 if ((*cp)->major > major ||
-                    ((*cp)->major == major && (*cp)->baseminor >= baseminor))
+                    ((*cp)->major == major &&
+                     (((*cp)->baseminor >= baseminor) ||
+                      ((*cp)->baseminor + (*cp)->minorct > baseminor))))
                         break;
-        if (*cp && (*cp)->major == major &&
-            (*cp)->baseminor < baseminor + minorct) {
-                ret = -EBUSY;
-                goto out;
+
+        /* Check for overlapping minor ranges.  */
+        if (*cp && (*cp)->major == major) {
+                int old_min = (*cp)->baseminor;
+                int old_max = (*cp)->baseminor + (*cp)->minorct - 1;
+                int new_min = baseminor;
+                int new_max = baseminor + minorct - 1;
+
+                /* New driver overlaps from the left.  */
+                if (new_max >= old_min && new_max <= old_max) {
+                        ret = -EBUSY;
+                        goto out;
+                }
+
+                /* New driver overlaps from the right.  */
+                if (new_min <= old_max && new_min >= old_min) {
+                        ret = -EBUSY;
+                        goto out;
+                }
         }
+
         cd->next = *cp;
         *cp = cd;
         mutex_unlock(&chrdevs_lock);
@@ -165,6 +184,15 @@ __unregister_chrdev_region(unsigned major, unsigned baseminor, int minorct)
         return cd;
 }
 
+/**
+ * register_chrdev_region() - register a range of device numbers
+ * @from: the first in the desired range of device numbers; must include
+ *        the major number.
+ * @count: the number of consecutive device numbers required
+ * @name: the name of the device or driver.
+ *
+ * Return value is zero on success, a negative error code on failure.
+ */
 int register_chrdev_region(dev_t from, unsigned count, const char *name)
 {
         struct char_device_struct *cd;
@@ -190,6 +218,17 @@ fail:
         return PTR_ERR(cd);
 }
 
+/**
+ * alloc_chrdev_region() - register a range of char device numbers
+ * @dev: output parameter for first assigned number
+ * @baseminor: first of the requested range of minor numbers
+ * @count: the number of minor numbers required
+ * @name: the name of the associated device or driver
+ *
+ * Allocates a range of char device numbers.  The major number will be
+ * chosen dynamically, and returned (along with the first minor number)
+ * in @dev.  Returns zero or a negative error code.
+ */
 int alloc_chrdev_region(dev_t *dev, unsigned baseminor, unsigned count,
                         const char *name)
 {
@@ -259,6 +298,15 @@ out2:
         return err;
 }
 
+/**
+ * unregister_chrdev_region() - return a range of device numbers
+ * @from: the first in the range of numbers to unregister
+ * @count: the number of device numbers to unregister
+ *
+ * This function will unregister a range of @count device numbers,
+ * starting with @from.  The caller should normally be the one who
+ * allocated those numbers in the first place...
+ */
 void unregister_chrdev_region(dev_t from, unsigned count)
 {
         dev_t to = from + count;
@@ -396,6 +444,16 @@ static int exact_lock(dev_t dev, void *data)
         return cdev_get(p) ? 0 : -1;
 }
 
+/**
+ * cdev_add() - add a char device to the system
+ * @p: the cdev structure for the device
+ * @dev: the first device number for which this device is responsible
+ * @count: the number of consecutive minor numbers corresponding to this
+ *         device
+ *
+ * cdev_add() adds the device represented by @p to the system, making it
+ * live immediately.  A negative error code is returned on failure.
+ */
 int cdev_add(struct cdev *p, dev_t dev, unsigned count)
 {
         p->dev = dev;
@@ -408,6 +466,13 @@ static void cdev_unmap(dev_t dev, unsigned count)
         kobj_unmap(cdev_map, dev, count);
 }
 
+/**
+ * cdev_del() - remove a cdev from the system
+ * @p: the cdev structure to be removed
+ *
+ * cdev_del() removes @p from the system, possibly freeing the structure
+ * itself.
+ */
 void cdev_del(struct cdev *p)
 {
         cdev_unmap(p->dev, p->count);
@@ -436,6 +501,11 @@ static struct kobj_type ktype_cdev_dynamic = {
         .release        = cdev_dynamic_release,
 };
 
+/**
+ * cdev_alloc() - allocate a cdev structure
+ *
+ * Allocates and returns a cdev structure, or NULL on failure.
+ */
 struct cdev *cdev_alloc(void)
 {
         struct cdev *p = kzalloc(sizeof(struct cdev), GFP_KERNEL);
@@ -447,6 +517,14 @@ struct cdev *cdev_alloc(void)
         return p;
 }
 
+/**
+ * cdev_init() - initialize a cdev structure
+ * @cdev: the structure to initialize
+ * @fops: the file_operations for this device
+ *
+ * Initializes @cdev, remembering @fops, making it ready to add to the
+ * system with cdev_add().
+ */
 void cdev_init(struct cdev *cdev, const struct file_operations *fops)
 {
         memset(cdev, 0, sizeof *cdev);