Fedora kernel-2.6.17-1.2142_FC4 patched with stable patch-2.6.17.4-vs2.0.2-rc26.diff
[linux-2.6.git] / drivers / usb / input / hiddev.c
index c995d93..c4670e1 100644 (file)
@@ -35,7 +35,6 @@
 #include <linux/usb.h>
 #include "hid.h"
 #include <linux/hiddev.h>
-#include <linux/devfs_fs_kernel.h>
 
 #ifdef CONFIG_USB_DYNAMIC_MINORS
 #define HIDDEV_MINOR_BASE      0
@@ -66,9 +65,6 @@ struct hiddev_list {
 
 static struct hiddev *hiddev_table[HIDDEV_MINORS];
 
-/* forward reference to make our lives easier */
-extern struct usb_driver hiddev_driver;
-
 /*
  * Find a report, given the report's type and ID.  The ID can be specified
  * indirectly by REPORT_ID_FIRST (which returns the first report of the given
@@ -98,7 +94,7 @@ hiddev_lookup_report(struct hid_device *hid, struct hiddev_report_info *rinfo)
                        return NULL;
                rinfo->report_id = ((struct hid_report *) list)->id;
                break;
-               
+
        case HID_REPORT_ID_NEXT:
                list = (struct list_head *)
                        report_enum->report_id_hash[rinfo->report_id & HID_REPORT_ID_MASK];
@@ -109,7 +105,7 @@ hiddev_lookup_report(struct hid_device *hid, struct hiddev_report_info *rinfo)
                        return NULL;
                rinfo->report_id = ((struct hid_report *) list)->id;
                break;
-               
+
        default:
                return NULL;
        }
@@ -127,7 +123,6 @@ hiddev_lookup_usage(struct hid_device *hid, struct hiddev_usage_ref *uref)
        int i, j;
        struct hid_report *report;
        struct hid_report_enum *report_enum;
-       struct list_head *list;
        struct hid_field *field;
 
        if (uref->report_type < HID_REPORT_TYPE_MIN ||
@@ -135,9 +130,8 @@ hiddev_lookup_usage(struct hid_device *hid, struct hiddev_usage_ref *uref)
 
        report_enum = hid->report_enum +
                (uref->report_type - HID_REPORT_TYPE_MIN);
-       list = report_enum->report_list.next;
-       while (list != &report_enum->report_list) {
-               report = (struct hid_report *) list;
+
+       list_for_each_entry(report, &report_enum->report_list, list)
                for (i = 0; i < report->maxfield; i++) {
                        field = report->field[i];
                        for (j = 0; j < field->maxusage; j++) {
@@ -149,8 +143,6 @@ hiddev_lookup_usage(struct hid_device *hid, struct hiddev_usage_ref *uref)
                                }
                        }
                }
-               list = list->next;
-       }
 
        return NULL;
 }
@@ -165,7 +157,7 @@ static void hiddev_send_event(struct hid_device *hid,
                if (uref->field_index != HID_FIELD_INDEX_NONE ||
                    (list->flags & HIDDEV_FLAG_REPORT) != 0) {
                        list->buffer[list->head] = *uref;
-                       list->head = (list->head + 1) & 
+                       list->head = (list->head + 1) &
                                (HIDDEV_BUFFER_SIZE - 1);
                        kill_fasync(&list->fasync, SIGIO, POLL_IN);
                }
@@ -186,9 +178,9 @@ void hiddev_hid_event(struct hid_device *hid, struct hid_field *field,
        unsigned type = field->report_type;
        struct hiddev_usage_ref uref;
 
-       uref.report_type = 
+       uref.report_type =
          (type == HID_INPUT_REPORT) ? HID_REPORT_TYPE_INPUT :
-         ((type == HID_OUTPUT_REPORT) ? HID_REPORT_TYPE_OUTPUT : 
+         ((type == HID_OUTPUT_REPORT) ? HID_REPORT_TYPE_OUTPUT :
           ((type == HID_FEATURE_REPORT) ? HID_REPORT_TYPE_FEATURE:0));
        uref.report_id = field->report->id;
        uref.field_index = field->index;
@@ -206,9 +198,9 @@ void hiddev_report_event(struct hid_device *hid, struct hid_report *report)
        struct hiddev_usage_ref uref;
 
        memset(&uref, 0, sizeof(uref));
-       uref.report_type = 
+       uref.report_type =
          (type == HID_INPUT_REPORT) ? HID_REPORT_TYPE_INPUT :
-         ((type == HID_OUTPUT_REPORT) ? HID_REPORT_TYPE_OUTPUT : 
+         ((type == HID_OUTPUT_REPORT) ? HID_REPORT_TYPE_OUTPUT :
           ((type == HID_FEATURE_REPORT) ? HID_REPORT_TYPE_FEATURE:0));
        uref.report_id = report->id;
        uref.field_index = HID_FIELD_INDEX_NONE;
@@ -226,16 +218,6 @@ static int hiddev_fasync(int fd, struct file *file, int on)
        return retval < 0 ? retval : 0;
 }
 
-/*
- * De-allocate a hiddev structure
- */
-static struct usb_class_driver hiddev_class;
-static void hiddev_cleanup(struct hiddev *hiddev)
-{
-       hiddev_table[hiddev->hid->minor - HIDDEV_MINOR_BASE] = NULL;
-       usb_deregister_dev(hiddev->hid->intf, &hiddev_class);
-       kfree(hiddev);
-}
 
 /*
  * release file op
@@ -253,10 +235,10 @@ static int hiddev_release(struct inode * inode, struct file * file)
        *listptr = (*listptr)->next;
 
        if (!--list->hiddev->open) {
-               if (list->hiddev->exist) 
+               if (list->hiddev->exist)
                        hid_close(list->hiddev->hid);
                else
-                       hiddev_cleanup(list->hiddev);
+                       kfree(list->hiddev);
        }
 
        kfree(list);
@@ -275,9 +257,8 @@ static int hiddev_open(struct inode * inode, struct file * file) {
        if (i >= HIDDEV_MINORS || !hiddev_table[i])
                return -ENODEV;
 
-       if (!(list = kmalloc(sizeof(struct hiddev_list), GFP_KERNEL)))
+       if (!(list = kzalloc(sizeof(struct hiddev_list), GFP_KERNEL)))
                return -ENOMEM;
-       memset(list, 0, sizeof(struct hiddev_list));
 
        list->hiddev = hiddev_table[i];
        list->next = hiddev_table[i]->list;
@@ -295,7 +276,7 @@ static int hiddev_open(struct inode * inode, struct file * file) {
 /*
  * "write" file op
  */
-static ssize_t hiddev_write(struct file * file, const char * buffer, size_t count, loff_t *ppos)
+static ssize_t hiddev_write(struct file * file, const char __user * buffer, size_t count, loff_t *ppos)
 {
        return -EINVAL;
 }
@@ -303,7 +284,7 @@ static ssize_t hiddev_write(struct file * file, const char * buffer, size_t coun
 /*
  * "read" file op
  */
-static ssize_t hiddev_read(struct file * file, char * buffer, size_t count, loff_t *ppos)
+static ssize_t hiddev_read(struct file * file, char __user * buffer, size_t count, loff_t *ppos)
 {
        DECLARE_WAITQUEUE(wait, current);
        struct hiddev_list *list = file->private_data;
@@ -320,7 +301,7 @@ static ssize_t hiddev_read(struct file * file, char * buffer, size_t count, loff
                if (list->head == list->tail) {
                        add_wait_queue(&list->hiddev->wait, &wait);
                        set_current_state(TASK_INTERRUPTIBLE);
-                       
+
                        while (list->head == list->tail) {
                                if (file->f_flags & O_NONBLOCK) {
                                        retval = -EAGAIN;
@@ -334,8 +315,9 @@ static ssize_t hiddev_read(struct file * file, char * buffer, size_t count, loff
                                        retval = -EIO;
                                        break;
                                }
-                               
+
                                schedule();
+                               set_current_state(TASK_INTERRUPTIBLE);
                        }
 
                        set_current_state(TASK_RUNNING);
@@ -346,7 +328,7 @@ static ssize_t hiddev_read(struct file * file, char * buffer, size_t count, loff
                        return retval;
 
 
-               while (list->head != list->tail && 
+               while (list->head != list->tail &&
                       retval + event_size <= count) {
                        if ((list->flags & HIDDEV_FLAG_UREF) == 0) {
                                if (list->buffer[list->tail].field_index !=
@@ -406,6 +388,7 @@ static int hiddev_ioctl(struct inode *inode, struct file *file, unsigned int cmd
        struct hiddev_devinfo dinfo;
        struct hid_report *report;
        struct hid_field *field;
+       void __user *user_arg = (void __user *)arg;
        int i;
 
        if (!hiddev->exist)
@@ -414,17 +397,17 @@ static int hiddev_ioctl(struct inode *inode, struct file *file, unsigned int cmd
        switch (cmd) {
 
        case HIDIOCGVERSION:
-               return put_user(HID_VERSION, (int *) arg);
+               return put_user(HID_VERSION, (int __user *)arg);
 
        case HIDIOCAPPLICATION:
                if (arg < 0 || arg >= hid->maxapplication)
                        return -EINVAL;
 
                for (i = 0; i < hid->maxcollection; i++)
-                       if (hid->collection[i].type == 
+                       if (hid->collection[i].type ==
                            HID_COLLECTION_APPLICATION && arg-- == 0)
                                break;
-               
+
                if (i == hid->maxcollection)
                        return -EINVAL;
 
@@ -435,17 +418,17 @@ static int hiddev_ioctl(struct inode *inode, struct file *file, unsigned int cmd
                dinfo.busnum = dev->bus->busnum;
                dinfo.devnum = dev->devnum;
                dinfo.ifnum = hid->ifnum;
-               dinfo.vendor = dev->descriptor.idVendor;
-               dinfo.product = dev->descriptor.idProduct;
-               dinfo.version = dev->descriptor.bcdDevice;
+               dinfo.vendor = le16_to_cpu(dev->descriptor.idVendor);
+               dinfo.product = le16_to_cpu(dev->descriptor.idProduct);
+               dinfo.version = le16_to_cpu(dev->descriptor.bcdDevice);
                dinfo.num_applications = hid->maxapplication;
-               if (copy_to_user((void *) arg, &dinfo, sizeof(dinfo)))
+               if (copy_to_user(user_arg, &dinfo, sizeof(dinfo)))
                        return -EFAULT;
 
                return 0;
 
        case HIDIOCGFLAG:
-               if (put_user(list->flags, (int *) arg))
+               if (put_user(list->flags, (int __user *)arg))
                        return -EFAULT;
 
                return 0;
@@ -453,7 +436,7 @@ static int hiddev_ioctl(struct inode *inode, struct file *file, unsigned int cmd
        case HIDIOCSFLAG:
                {
                        int newflags;
-                       if (get_user(newflags, (int *) arg))
+                       if (get_user(newflags, (int __user *)arg))
                                return -EFAULT;
 
                        if ((newflags & ~HIDDEV_FLAGS) != 0 ||
@@ -471,7 +454,7 @@ static int hiddev_ioctl(struct inode *inode, struct file *file, unsigned int cmd
                        int idx, len;
                        char *buf;
 
-                       if (get_user(idx, (int *) arg))
+                       if (get_user(idx, (int __user *)arg))
                                return -EFAULT;
 
                        if ((buf = kmalloc(HID_STRING_SIZE, GFP_KERNEL)) == NULL)
@@ -482,7 +465,7 @@ static int hiddev_ioctl(struct inode *inode, struct file *file, unsigned int cmd
                                return -EINVAL;
                        }
 
-                       if (copy_to_user((void *) (arg+sizeof(int)), buf, len+1)) {
+                       if (copy_to_user(user_arg+sizeof(int), buf, len+1)) {
                                kfree(buf);
                                return -EFAULT;
                        }
@@ -498,7 +481,7 @@ static int hiddev_ioctl(struct inode *inode, struct file *file, unsigned int cmd
                return 0;
 
        case HIDIOCGREPORT:
-               if (copy_from_user(&rinfo, (void *) arg, sizeof(rinfo)))
+               if (copy_from_user(&rinfo, user_arg, sizeof(rinfo)))
                        return -EFAULT;
 
                if (rinfo.report_type == HID_REPORT_TYPE_OUTPUT)
@@ -513,7 +496,7 @@ static int hiddev_ioctl(struct inode *inode, struct file *file, unsigned int cmd
                return 0;
 
        case HIDIOCSREPORT:
-               if (copy_from_user(&rinfo, (void *) arg, sizeof(rinfo)))
+               if (copy_from_user(&rinfo, user_arg, sizeof(rinfo)))
                        return -EFAULT;
 
                if (rinfo.report_type == HID_REPORT_TYPE_INPUT)
@@ -523,11 +506,12 @@ static int hiddev_ioctl(struct inode *inode, struct file *file, unsigned int cmd
                        return -EINVAL;
 
                hid_submit_report(hid, report, USB_DIR_OUT);
+               hid_wait_io(hid);
 
                return 0;
 
        case HIDIOCGREPORTINFO:
-               if (copy_from_user(&rinfo, (void *) arg, sizeof(rinfo)))
+               if (copy_from_user(&rinfo, user_arg, sizeof(rinfo)))
                        return -EFAULT;
 
                if ((report = hiddev_lookup_report(hid, &rinfo)) == NULL)
@@ -535,13 +519,13 @@ static int hiddev_ioctl(struct inode *inode, struct file *file, unsigned int cmd
 
                rinfo.num_fields = report->maxfield;
 
-               if (copy_to_user((void *) arg, &rinfo, sizeof(rinfo)))
+               if (copy_to_user(user_arg, &rinfo, sizeof(rinfo)))
                        return -EFAULT;
 
                return 0;
 
        case HIDIOCGFIELDINFO:
-               if (copy_from_user(&finfo, (void *) arg, sizeof(finfo)))
+               if (copy_from_user(&finfo, user_arg, sizeof(finfo)))
                        return -EFAULT;
                rinfo.report_type = finfo.report_type;
                rinfo.report_id = finfo.report_id;
@@ -568,7 +552,7 @@ static int hiddev_ioctl(struct inode *inode, struct file *file, unsigned int cmd
                finfo.unit_exponent = field->unit_exponent;
                finfo.unit = field->unit;
 
-               if (copy_to_user((void *) arg, &finfo, sizeof(finfo)))
+               if (copy_to_user(user_arg, &finfo, sizeof(finfo)))
                        return -EFAULT;
 
                return 0;
@@ -578,7 +562,7 @@ static int hiddev_ioctl(struct inode *inode, struct file *file, unsigned int cmd
                if (!uref_multi)
                        return -ENOMEM;
                uref = &uref_multi->uref;
-               if (copy_from_user(uref, (void *) arg, sizeof(*uref))) 
+               if (copy_from_user(uref, user_arg, sizeof(*uref)))
                        goto fault;
 
                rinfo.report_type = uref->report_type;
@@ -595,7 +579,7 @@ static int hiddev_ioctl(struct inode *inode, struct file *file, unsigned int cmd
 
                uref->usage_code = field->usage[uref->usage_index].hid;
 
-               if (copy_to_user((void *) arg, uref, sizeof(*uref)))
+               if (copy_to_user(user_arg, uref, sizeof(*uref)))
                        goto fault;
 
                kfree(uref_multi);
@@ -611,15 +595,15 @@ static int hiddev_ioctl(struct inode *inode, struct file *file, unsigned int cmd
                        return -ENOMEM;
                uref = &uref_multi->uref;
                if (cmd == HIDIOCGUSAGES || cmd == HIDIOCSUSAGES) {
-                       if (copy_from_user(uref_multi, (void *) arg, 
+                       if (copy_from_user(uref_multi, user_arg,
                                           sizeof(*uref_multi)))
                                goto fault;
                } else {
-                       if (copy_from_user(uref, (void *) arg, sizeof(*uref)))
+                       if (copy_from_user(uref, user_arg, sizeof(*uref)))
                                goto fault;
                }
 
-               if (cmd != HIDIOCGUSAGE && 
+               if (cmd != HIDIOCGUSAGE &&
                    cmd != HIDIOCGUSAGES &&
                    uref->report_type == HID_REPORT_TYPE_INPUT)
                        goto inval;
@@ -638,21 +622,23 @@ static int hiddev_ioctl(struct inode *inode, struct file *file, unsigned int cmd
                                goto inval;
 
                        field = report->field[uref->field_index];
-                       if (uref->usage_index >= field->maxusage)
-                               goto inval;
 
-                       if (cmd == HIDIOCGUSAGES || cmd == HIDIOCSUSAGES) {
-                               if (uref_multi->num_values >= HID_MAX_USAGES || 
-                                   uref->usage_index >= field->maxusage || 
-                                  (uref->usage_index + uref_multi->num_values) >= field->maxusage)
+                       if (cmd == HIDIOCGCOLLECTIONINDEX) {
+                               if (uref->usage_index >= field->maxusage)
                                        goto inval;
+                       } else if (uref->usage_index >= field->report_count)
+                               goto inval;
+
+                       else if ((cmd == HIDIOCGUSAGES || cmd == HIDIOCSUSAGES) &&
+                                (uref_multi->num_values > HID_MAX_MULTI_USAGES ||
+                                 uref->usage_index + uref_multi->num_values > field->report_count))
+                               goto inval;
                        }
-               }
 
                switch (cmd) {
                        case HIDIOCGUSAGE:
                                uref->value = field->value[uref->usage_index];
-                               if (copy_to_user((void *) arg, uref, sizeof(*uref)))
+                               if (copy_to_user(user_arg, uref, sizeof(*uref)))
                                        goto fault;
                                goto goodreturn;
 
@@ -665,16 +651,16 @@ static int hiddev_ioctl(struct inode *inode, struct file *file, unsigned int cmd
                                return field->usage[uref->usage_index].collection_index;
                        case HIDIOCGUSAGES:
                                for (i = 0; i < uref_multi->num_values; i++)
-                                       uref_multi->values[i] = 
+                                       uref_multi->values[i] =
                                            field->value[uref->usage_index + i];
-                               if (copy_to_user((void *) arg, uref_multi, 
+                               if (copy_to_user(user_arg, uref_multi,
                                                 sizeof(*uref_multi)))
                                        goto fault;
                                goto goodreturn;
                        case HIDIOCSUSAGES:
                                for (i = 0; i < uref_multi->num_values; i++)
-                                       field->value[uref->usage_index + i] = 
-                                           uref_multi->values[i];
+                                       field->value[uref->usage_index + i] =
+                                           uref_multi->values[i];
                                goto goodreturn;
                }
 
@@ -684,12 +670,12 @@ goodreturn:
 fault:
                kfree(uref_multi);
                return -EFAULT;
-inval:         
+inval:
                kfree(uref_multi);
                return -EINVAL;
 
        case HIDIOCGCOLLECTIONINFO:
-               if (copy_from_user(&cinfo, (void *) arg, sizeof(cinfo)))
+               if (copy_from_user(&cinfo, user_arg, sizeof(cinfo)))
                        return -EFAULT;
 
                if (cinfo.index >= hid->maxcollection)
@@ -699,7 +685,7 @@ inval:
                cinfo.usage = hid->collection[cinfo.index].usage;
                cinfo.level = hid->collection[cinfo.index].level;
 
-               if (copy_to_user((void *) arg, &cinfo, sizeof(cinfo)))
+               if (copy_to_user(user_arg, &cinfo, sizeof(cinfo)))
                        return -EFAULT;
                return 0;
 
@@ -715,7 +701,7 @@ inval:
                        len = strlen(hid->name) + 1;
                        if (len > _IOC_SIZE(cmd))
                                 len = _IOC_SIZE(cmd);
-                       return copy_to_user((char *) arg, hid->name, len) ?
+                       return copy_to_user(user_arg, hid->name, len) ?
                                -EFAULT : len;
                }
 
@@ -726,7 +712,7 @@ inval:
                        len = strlen(hid->phys) + 1;
                        if (len > _IOC_SIZE(cmd))
                                len = _IOC_SIZE(cmd);
-                       return copy_to_user((char *) arg, hid->phys, len) ?
+                       return copy_to_user(user_arg, hid->phys, len) ?
                                -EFAULT : len;
                }
        }
@@ -745,10 +731,9 @@ static struct file_operations hiddev_fops = {
 };
 
 static struct usb_class_driver hiddev_class = {
-       .name =         "usb/hid/hiddev%d",
+       .name =         "hiddev%d",
        .fops =         &hiddev_fops,
-       .mode =         S_IFCHR | S_IRUGO | S_IWUSR,
-               .minor_base =   HIDDEV_MINOR_BASE,
+       .minor_base =   HIDDEV_MINOR_BASE,
 };
 
 /*
@@ -761,7 +746,7 @@ int hiddev_connect(struct hid_device *hid)
        int retval;
 
        for (i = 0; i < hid->maxcollection; i++)
-               if (hid->collection[i].type == 
+               if (hid->collection[i].type ==
                    HID_COLLECTION_APPLICATION &&
                    !IS_INPUT_APPLICATION(hid->collection[i].usage))
                        break;
@@ -769,11 +754,10 @@ int hiddev_connect(struct hid_device *hid)
        if (i == hid->maxcollection && (hid->quirks & HID_QUIRK_HIDDEV) == 0)
                return -1;
 
-       if (!(hiddev = kmalloc(sizeof(struct hiddev), GFP_KERNEL)))
+       if (!(hiddev = kzalloc(sizeof(struct hiddev), GFP_KERNEL)))
                return -1;
-       memset(hiddev, 0, sizeof(struct hiddev));
 
-       retval = usb_register_dev(hid->intf, &hiddev_class);
+       retval = usb_register_dev(hid->intf, &hiddev_class);
        if (retval) {
                err("Not able to get a minor for this device.");
                kfree(hiddev);
@@ -782,12 +766,12 @@ int hiddev_connect(struct hid_device *hid)
 
        init_waitqueue_head(&hiddev->wait);
 
-       hiddev_table[hid->intf->minor - HIDDEV_MINOR_BASE] = hiddev;
+       hiddev_table[hid->intf->minor - HIDDEV_MINOR_BASE] = hiddev;
 
        hiddev->hid = hid;
        hiddev->exist = 1;
 
-       hid->minor = hid->intf->minor;
+       hid->minor = hid->intf->minor;
        hid->hiddev = hiddev;
 
        return 0;
@@ -797,17 +781,21 @@ int hiddev_connect(struct hid_device *hid)
  * This is where hid.c calls us to disconnect a hiddev device from the
  * corresponding hid device (usually because the usb device has disconnected)
  */
+static struct usb_class_driver hiddev_class;
 void hiddev_disconnect(struct hid_device *hid)
 {
        struct hiddev *hiddev = hid->hiddev;
 
        hiddev->exist = 0;
 
+       hiddev_table[hiddev->hid->minor - HIDDEV_MINOR_BASE] = NULL;
+       usb_deregister_dev(hiddev->hid->intf, &hiddev_class);
+
        if (hiddev->open) {
                hid_close(hiddev->hid);
                wake_up_interruptible(&hiddev->wait);
        } else {
-               hiddev_cleanup(hiddev);
+               kfree(hiddev);
        }
 }
 
@@ -828,7 +816,7 @@ void hiddev_disconnect(struct hid_device *hid)
 /* We never attach in this manner, and rely on HID to connect us.  This
  * is why there is no disconnect routine defined in the usb_driver either.
  */
-static int hiddev_usbd_probe(struct usb_interface *intf, 
+static int hiddev_usbd_probe(struct usb_interface *intf,
                             const struct usb_device_id *hiddev_info)
 {
        return -ENODEV;
@@ -836,19 +824,16 @@ static int hiddev_usbd_probe(struct usb_interface *intf,
 
 
 static /* const */ struct usb_driver hiddev_driver = {
-       .owner =        THIS_MODULE,
        .name =         "hiddev",
        .probe =        hiddev_usbd_probe,
 };
 
 int __init hiddev_init(void)
 {
-       devfs_mk_dir("usb/hid");
        return usb_register(&hiddev_driver);
 }
 
 void hiddev_exit(void)
 {
        usb_deregister(&hiddev_driver);
-       devfs_remove("usb/hid");
 }