X-Git-Url: http://git.onelab.eu/?a=blobdiff_plain;f=arch%2Fmips%2Fkernel%2Fsysirix.c;fp=arch%2Fmips%2Fkernel%2Fsysirix.c;h=a456f78a3bf66e69ac21e3c67f4571c9508ea124;hb=43bc926fffd92024b46cafaf7350d669ba9ca884;hp=2d17014ff16f6a73e3a764f7f926714da22a08eb;hpb=cee37fe97739d85991964371c1f3a745c00dd236;p=linux-2.6.git diff --git a/arch/mips/kernel/sysirix.c b/arch/mips/kernel/sysirix.c index 2d17014ff..a456f78a3 100644 --- a/arch/mips/kernel/sysirix.c +++ b/arch/mips/kernel/sysirix.c @@ -8,6 +8,7 @@ #include #include #include +#include #include #include #include @@ -74,32 +75,30 @@ asmlinkage int irix_sysmp(struct pt_regs *regs) } /* The prctl commands. */ -#define PR_MAXPROCS 1 /* Tasks/user. */ -#define PR_ISBLOCKED 2 /* If blocked, return 1. */ -#define PR_SETSTACKSIZE 3 /* Set largest task stack size. */ -#define PR_GETSTACKSIZE 4 /* Get largest task stack size. */ -#define PR_MAXPPROCS 5 /* Num parallel tasks. */ -#define PR_UNBLKONEXEC 6 /* When task exec/exit's, unblock. */ -#define PR_SETEXITSIG 8 /* When task exit's, set signal. */ -#define PR_RESIDENT 9 /* Make task unswappable. */ -#define PR_ATTACHADDR 10 /* (Re-)Connect a vma to a task. */ -#define PR_DETACHADDR 11 /* Disconnect a vma from a task. */ -#define PR_TERMCHILD 12 /* When parent sleeps with fishes, kill child. */ -#define PR_GETSHMASK 13 /* Get the sproc() share mask. */ -#define PR_GETNSHARE 14 /* Number of share group members. */ -#define PR_COREPID 15 /* Add task pid to name when it core. */ -#define PR_ATTACHADDRPERM 16 /* (Re-)Connect vma, with specified prot. */ -#define PR_PTHREADEXIT 17 /* Kill a pthread without prejudice. */ - -asmlinkage int irix_prctl(struct pt_regs *regs) -{ - unsigned long cmd; - int error = 0, base = 0; +#define PR_MAXPROCS 1 /* Tasks/user. */ +#define PR_ISBLOCKED 2 /* If blocked, return 1. */ +#define PR_SETSTACKSIZE 3 /* Set largest task stack size. */ +#define PR_GETSTACKSIZE 4 /* Get largest task stack size. */ +#define PR_MAXPPROCS 5 /* Num parallel tasks. */ +#define PR_UNBLKONEXEC 6 /* When task exec/exit's, unblock. */ +#define PR_SETEXITSIG 8 /* When task exit's, set signal. */ +#define PR_RESIDENT 9 /* Make task unswappable. */ +#define PR_ATTACHADDR 10 /* (Re-)Connect a vma to a task. */ +#define PR_DETACHADDR 11 /* Disconnect a vma from a task. */ +#define PR_TERMCHILD 12 /* Kill child if the parent dies. */ +#define PR_GETSHMASK 13 /* Get the sproc() share mask. */ +#define PR_GETNSHARE 14 /* Number of share group members. */ +#define PR_COREPID 15 /* Add task pid to name when it core. */ +#define PR_ATTACHADDRPERM 16 /* (Re-)Connect vma, with specified prot. */ +#define PR_PTHREADEXIT 17 /* Kill a pthread, only for IRIX 6.[234] */ + +asmlinkage int irix_prctl(unsigned option, ...) +{ + va_list args; + int error = 0; - if (regs->regs[2] == 1000) - base = 1; - cmd = regs->regs[base + 4]; - switch (cmd) { + va_start(args, option); + switch (option) { case PR_MAXPROCS: printk("irix_prctl[%s:%d]: Wants PR_MAXPROCS\n", current->comm, current->pid); @@ -112,7 +111,7 @@ asmlinkage int irix_prctl(struct pt_regs *regs) printk("irix_prctl[%s:%d]: Wants PR_ISBLOCKED\n", current->comm, current->pid); read_lock(&tasklist_lock); - task = find_task_by_pid(regs->regs[base + 5]); + task = find_task_by_pid(va_arg(args, pid_t)); error = -ESRCH; if (error) error = (task->run_list.next != NULL); @@ -122,7 +121,7 @@ asmlinkage int irix_prctl(struct pt_regs *regs) } case PR_SETSTACKSIZE: { - long value = regs->regs[base + 5]; + long value = va_arg(args, long); printk("irix_prctl[%s:%d]: Wants PR_SETSTACKSIZE<%08lx>\n", current->comm, current->pid, (unsigned long) value); @@ -223,24 +222,20 @@ asmlinkage int irix_prctl(struct pt_regs *regs) error = -EINVAL; break; - case PR_PTHREADEXIT: - printk("irix_prctl[%s:%d]: Wants PR_PTHREADEXIT\n", - current->comm, current->pid); - do_exit(regs->regs[base + 5]); - default: printk("irix_prctl[%s:%d]: Non-existant opcode %d\n", - current->comm, current->pid, (int)cmd); + current->comm, current->pid, option); error = -EINVAL; break; } + va_end(args); return error; } #undef DEBUG_PROCGRPS -extern unsigned long irix_mapelf(int fd, struct elf_phdr *user_phdrp, int cnt); +extern unsigned long irix_mapelf(int fd, struct elf_phdr __user *user_phdrp, int cnt); extern int getrusage(struct task_struct *p, int who, struct rusage __user *ru); extern char *prom_getenv(char *name); extern long prom_setenv(char *name, char *value); @@ -277,23 +272,19 @@ asmlinkage int irix_syssgi(struct pt_regs *regs) cmd = regs->regs[base + 4]; switch(cmd) { case SGI_SYSID: { - char *buf = (char *) regs->regs[base + 5]; + char __user *buf = (char __user *) regs->regs[base + 5]; /* XXX Use ethernet addr.... */ - retval = clear_user(buf, 64); + retval = clear_user(buf, 64) ? -EFAULT : 0; break; } #if 0 case SGI_RDNAME: { int pid = (int) regs->regs[base + 5]; - char *buf = (char *) regs->regs[base + 6]; + char __user *buf = (char __user *) regs->regs[base + 6]; struct task_struct *p; char tcomm[sizeof(current->comm)]; - if (!access_ok(VERIFY_WRITE, buf, sizeof(tcomm))) { - retval = -EFAULT; - break; - } read_lock(&tasklist_lock); p = find_task_by_pid(pid); if (!p) { @@ -305,34 +296,28 @@ asmlinkage int irix_syssgi(struct pt_regs *regs) read_unlock(&tasklist_lock); /* XXX Need to check sizes. */ - copy_to_user(buf, tcomm, sizeof(tcomm)); - retval = 0; + retval = copy_to_user(buf, tcomm, sizeof(tcomm)) ? -EFAULT : 0; break; } case SGI_GETNVRAM: { - char *name = (char *) regs->regs[base+5]; - char *buf = (char *) regs->regs[base+6]; + char __user *name = (char __user *) regs->regs[base+5]; + char __user *buf = (char __user *) regs->regs[base+6]; char *value; return -EINVAL; /* til I fix it */ - if (!access_ok(VERIFY_WRITE, buf, 128)) { - retval = -EFAULT; - break; - } value = prom_getenv(name); /* PROM lock? */ if (!value) { retval = -EINVAL; break; } /* Do I strlen() for the length? */ - copy_to_user(buf, value, 128); - retval = 0; + retval = copy_to_user(buf, value, 128) ? -EFAULT : 0; break; } case SGI_SETNVRAM: { - char *name = (char *) regs->regs[base+5]; - char *value = (char *) regs->regs[base+6]; + char __user *name = (char __user *) regs->regs[base+5]; + char __user *value = (char __user *) regs->regs[base+6]; return -EINVAL; /* til I fix it */ retval = prom_setenv(name, value); /* XXX make sure retval conforms to syssgi(2) */ @@ -408,16 +393,16 @@ asmlinkage int irix_syssgi(struct pt_regs *regs) case SGI_SETGROUPS: retval = sys_setgroups((int) regs->regs[base + 5], - (gid_t *) regs->regs[base + 6]); + (gid_t __user *) regs->regs[base + 6]); break; case SGI_GETGROUPS: retval = sys_getgroups((int) regs->regs[base + 5], - (gid_t *) regs->regs[base + 6]); + (gid_t __user *) regs->regs[base + 6]); break; case SGI_RUSAGE: { - struct rusage *ru = (struct rusage *) regs->regs[base + 6]; + struct rusage __user *ru = (struct rusage __user *) regs->regs[base + 6]; switch((int) regs->regs[base + 5]) { case 0: @@ -454,7 +439,7 @@ asmlinkage int irix_syssgi(struct pt_regs *regs) case SGI_ELFMAP: retval = irix_mapelf((int) regs->regs[base + 5], - (struct elf_phdr *) regs->regs[base + 6], + (struct elf_phdr __user *) regs->regs[base + 6], (int) regs->regs[base + 7]); break; @@ -469,24 +454,24 @@ asmlinkage int irix_syssgi(struct pt_regs *regs) case SGI_PHYSP: { unsigned long addr = regs->regs[base + 5]; - int *pageno = (int *) (regs->regs[base + 6]); + int __user *pageno = (int __user *) (regs->regs[base + 6]); struct mm_struct *mm = current->mm; pgd_t *pgdp; + pud_t *pudp; pmd_t *pmdp; pte_t *ptep; - if (!access_ok(VERIFY_WRITE, pageno, sizeof(int))) - return -EFAULT; - down_read(&mm->mmap_sem); pgdp = pgd_offset(mm, addr); - pmdp = pmd_offset(pgdp, addr); + pudp = pud_offset(pgdp, addr); + pmdp = pmd_offset(pudp, addr); ptep = pte_offset(pmdp, addr); retval = -EINVAL; if (ptep) { pte_t pte = *ptep; if (pte_val(pte) & (_PAGE_VALID | _PAGE_PRESENT)) { + /* b0rked on 64-bit */ retval = put_user((pte_val(pte) & PAGE_MASK) >> PAGE_SHIFT, pageno); } @@ -497,7 +482,7 @@ asmlinkage int irix_syssgi(struct pt_regs *regs) case SGI_INVENT: { int arg1 = (int) regs->regs [base + 5]; - void *buffer = (void *) regs->regs [base + 6]; + void __user *buffer = (void __user *) regs->regs [base + 6]; int count = (int) regs->regs [base + 7]; switch (arg1) { @@ -582,19 +567,13 @@ asmlinkage int irix_brk(unsigned long brk) } /* - * Check if we have enough memory.. + * Ok, looks good - let it rip. */ - if (security_vm_enough_memory((newbrk-oldbrk) >> PAGE_SHIFT) || - !vx_vmpages_avail(mm, (newbrk-oldbrk) >> PAGE_SHIFT)) { + if (do_brk(oldbrk, newbrk-oldbrk) != oldbrk) { ret = -ENOMEM; goto out; } - - /* - * Ok, looks good - let it rip. - */ mm->brk = brk; - do_brk(oldbrk, newbrk-oldbrk); ret = 0; out: @@ -634,10 +613,7 @@ asmlinkage int irix_stime(int value) write_seqlock_irq(&xtime_lock); xtime.tv_sec = value; xtime.tv_nsec = 0; - time_adjust = 0; /* stop active adjtime() */ - time_status |= STA_UNSYNC; - time_maxerror = NTP_PHASE_LIMIT; - time_esterror = NTP_PHASE_LIMIT; + ntp_clear(); write_sequnlock_irq(&xtime_lock); return 0; @@ -670,27 +646,7 @@ static inline void getitimer_real(struct itimerval *value) asmlinkage unsigned int irix_alarm(unsigned int seconds) { - struct itimerval it_new, it_old; - unsigned int oldalarm; - - if (!seconds) { - getitimer_real(&it_old); - del_timer(¤t->real_timer); - } else { - it_new.it_interval.tv_sec = it_new.it_interval.tv_usec = 0; - it_new.it_value.tv_sec = seconds; - it_new.it_value.tv_usec = 0; - do_setitimer(ITIMER_REAL, &it_new, &it_old); - } - oldalarm = it_old.it_value.tv_sec; - /* - * ehhh.. We can't return 0 if we have an alarm pending ... - * And we'd better return too much than too little anyway - */ - if (it_old.it_value.tv_usec) - oldalarm++; - - return oldalarm; + return alarm_setitimer(seconds); } asmlinkage int irix_pause(void) @@ -702,8 +658,8 @@ asmlinkage int irix_pause(void) } /* XXX need more than this... */ -asmlinkage int irix_mount(char *dev_name, char *dir_name, unsigned long flags, - char *type, void *data, int datalen) +asmlinkage int irix_mount(char __user *dev_name, char __user *dir_name, + unsigned long flags, char __user *type, void __user *data, int datalen) { printk("[%s:%d] irix_mount(%p,%p,%08lx,%p,%p,%d)\n", current->comm, current->pid, @@ -718,8 +674,8 @@ struct irix_statfs { char f_fname[6], f_fpack[6]; }; -asmlinkage int irix_statfs(const char *path, struct irix_statfs *buf, - int len, int fs_type) +asmlinkage int irix_statfs(const char __user *path, + struct irix_statfs __user *buf, int len, int fs_type) { struct nameidata nd; struct kstatfs kbuf; @@ -734,6 +690,7 @@ asmlinkage int irix_statfs(const char *path, struct irix_statfs *buf, error = -EFAULT; goto out; } + error = user_path_walk(path, &nd); if (error) goto out; @@ -742,18 +699,17 @@ asmlinkage int irix_statfs(const char *path, struct irix_statfs *buf, if (error) goto dput_and_out; - __put_user(kbuf.f_type, &buf->f_type); - __put_user(kbuf.f_bsize, &buf->f_bsize); - __put_user(kbuf.f_frsize, &buf->f_frsize); - __put_user(kbuf.f_blocks, &buf->f_blocks); - __put_user(kbuf.f_bfree, &buf->f_bfree); - __put_user(kbuf.f_files, &buf->f_files); - __put_user(kbuf.f_ffree, &buf->f_ffree); + error = __put_user(kbuf.f_type, &buf->f_type); + error |= __put_user(kbuf.f_bsize, &buf->f_bsize); + error |= __put_user(kbuf.f_frsize, &buf->f_frsize); + error |= __put_user(kbuf.f_blocks, &buf->f_blocks); + error |= __put_user(kbuf.f_bfree, &buf->f_bfree); + error |= __put_user(kbuf.f_files, &buf->f_files); + error |= __put_user(kbuf.f_ffree, &buf->f_ffree); for (i = 0; i < 6; i++) { - __put_user(0, &buf->f_fname[i]); - __put_user(0, &buf->f_fpack[i]); + error |= __put_user(0, &buf->f_fname[i]); + error |= __put_user(0, &buf->f_fpack[i]); } - error = 0; dput_and_out: path_release(&nd); @@ -761,7 +717,7 @@ out: return error; } -asmlinkage int irix_fstatfs(unsigned int fd, struct irix_statfs *buf) +asmlinkage int irix_fstatfs(unsigned int fd, struct irix_statfs __user *buf) { struct kstatfs kbuf; struct file *file; @@ -771,6 +727,7 @@ asmlinkage int irix_fstatfs(unsigned int fd, struct irix_statfs *buf) error = -EFAULT; goto out; } + if (!(file = fget(fd))) { error = -EBADF; goto out; @@ -780,16 +737,17 @@ asmlinkage int irix_fstatfs(unsigned int fd, struct irix_statfs *buf) if (error) goto out_f; - __put_user(kbuf.f_type, &buf->f_type); - __put_user(kbuf.f_bsize, &buf->f_bsize); - __put_user(kbuf.f_frsize, &buf->f_frsize); - __put_user(kbuf.f_blocks, &buf->f_blocks); - __put_user(kbuf.f_bfree, &buf->f_bfree); - __put_user(kbuf.f_files, &buf->f_files); - __put_user(kbuf.f_ffree, &buf->f_ffree); - for(i = 0; i < 6; i++) { - __put_user(0, &buf->f_fname[i]); - __put_user(0, &buf->f_fpack[i]); + error = __put_user(kbuf.f_type, &buf->f_type); + error |= __put_user(kbuf.f_bsize, &buf->f_bsize); + error |= __put_user(kbuf.f_frsize, &buf->f_frsize); + error |= __put_user(kbuf.f_blocks, &buf->f_blocks); + error |= __put_user(kbuf.f_bfree, &buf->f_bfree); + error |= __put_user(kbuf.f_files, &buf->f_files); + error |= __put_user(kbuf.f_ffree, &buf->f_ffree); + + for (i = 0; i < 6; i++) { + error |= __put_user(0, &buf->f_fname[i]); + error |= __put_user(0, &buf->f_fpack[i]); } out_f: @@ -816,14 +774,15 @@ asmlinkage int irix_setpgrp(int flags) return error; } -asmlinkage int irix_times(struct tms * tbuf) +asmlinkage int irix_times(struct tms __user *tbuf) { int err = 0; if (tbuf) { if (!access_ok(VERIFY_WRITE,tbuf,sizeof *tbuf)) return -EFAULT; - err |= __put_user(current->utime, &tbuf->tms_utime); + + err = __put_user(current->utime, &tbuf->tms_utime); err |= __put_user(current->stime, &tbuf->tms_stime); err |= __put_user(current->signal->cutime, &tbuf->tms_cutime); err |= __put_user(current->signal->cstime, &tbuf->tms_cstime); @@ -839,13 +798,13 @@ asmlinkage int irix_exec(struct pt_regs *regs) if(regs->regs[2] == 1000) base = 1; - filename = getname((char *) (long)regs->regs[base + 4]); + filename = getname((char __user *) (long)regs->regs[base + 4]); error = PTR_ERR(filename); if (IS_ERR(filename)) return error; - error = do_execve(filename, (char **) (long)regs->regs[base + 5], - (char **) 0, regs); + error = do_execve(filename, (char __user * __user *) (long)regs->regs[base + 5], + NULL, regs); putname(filename); return error; @@ -858,12 +817,12 @@ asmlinkage int irix_exece(struct pt_regs *regs) if (regs->regs[2] == 1000) base = 1; - filename = getname((char *) (long)regs->regs[base + 4]); + filename = getname((char __user *) (long)regs->regs[base + 4]); error = PTR_ERR(filename); if (IS_ERR(filename)) return error; - error = do_execve(filename, (char **) (long)regs->regs[base + 5], - (char **) (long)regs->regs[base + 6], regs); + error = do_execve(filename, (char __user * __user *) (long)regs->regs[base + 5], + (char __user * __user *) (long)regs->regs[base + 6], regs); putname(filename); return error; @@ -919,22 +878,17 @@ asmlinkage int irix_socket(int family, int type, int protocol) return sys_socket(family, type, protocol); } -asmlinkage int irix_getdomainname(char *name, int len) +asmlinkage int irix_getdomainname(char __user *name, int len) { - int error; - - if (!access_ok(VERIFY_WRITE, name, len)) - return -EFAULT; + int err; down_read(&uts_sem); if (len > __NEW_UTS_LEN) len = __NEW_UTS_LEN; - error = 0; - if (copy_to_user(name, system_utsname.domainname, len)) - error = -EFAULT; + err = copy_to_user(name, vx_new_uts(domainname), len) ? -EFAULT : 0; up_read(&uts_sem); - return error; + return err; } asmlinkage unsigned long irix_getpagesize(void) @@ -950,12 +904,13 @@ asmlinkage int irix_msgsys(int opcode, unsigned long arg0, unsigned long arg1, case 0: return sys_msgget((key_t) arg0, (int) arg1); case 1: - return sys_msgctl((int) arg0, (int) arg1, (struct msqid_ds *)arg2); + return sys_msgctl((int) arg0, (int) arg1, + (struct msqid_ds __user *)arg2); case 2: - return sys_msgrcv((int) arg0, (struct msgbuf *) arg1, + return sys_msgrcv((int) arg0, (struct msgbuf __user *) arg1, (size_t) arg2, (long) arg3, (int) arg4); case 3: - return sys_msgsnd((int) arg0, (struct msgbuf *) arg1, + return sys_msgsnd((int) arg0, (struct msgbuf __user *) arg1, (size_t) arg2, (int) arg3); default: return -EINVAL; @@ -967,12 +922,13 @@ asmlinkage int irix_shmsys(int opcode, unsigned long arg0, unsigned long arg1, { switch (opcode) { case 0: - return do_shmat((int) arg0, (char *)arg1, (int) arg2, + return do_shmat((int) arg0, (char __user *) arg1, (int) arg2, (unsigned long *) arg3); case 1: - return sys_shmctl((int)arg0, (int)arg1, (struct shmid_ds *)arg2); + return sys_shmctl((int)arg0, (int)arg1, + (struct shmid_ds __user *)arg2); case 2: - return sys_shmdt((char *)arg0); + return sys_shmdt((char __user *)arg0); case 3: return sys_shmget((key_t) arg0, (int) arg1, (int) arg2); default: @@ -990,7 +946,7 @@ asmlinkage int irix_semsys(int opcode, unsigned long arg0, unsigned long arg1, case 1: return sys_semget((key_t) arg0, (int) arg1, (int) arg2); case 2: - return sys_semop((int) arg0, (struct sembuf *)arg1, + return sys_semop((int) arg0, (struct sembuf __user *)arg1, (unsigned int) arg2); default: return -EINVAL; @@ -1008,15 +964,16 @@ static inline loff_t llseek(struct file *file, loff_t offset, int origin) lock_kernel(); retval = fn(file, offset, origin); unlock_kernel(); + return retval; } asmlinkage int irix_lseek64(int fd, int _unused, int offhi, int offlow, int origin) { - int retval; struct file * file; loff_t offset; + int retval; retval = -EBADF; file = fget(fd); @@ -1037,17 +994,16 @@ bad: asmlinkage int irix_sginap(int ticks) { - current->state = TASK_INTERRUPTIBLE; - schedule_timeout(ticks); + schedule_timeout_interruptible(ticks); return 0; } -asmlinkage int irix_sgikopt(char *istring, char *ostring, int len) +asmlinkage int irix_sgikopt(char __user *istring, char __user *ostring, int len) { return -EINVAL; } -asmlinkage int irix_gettimeofday(struct timeval *tv) +asmlinkage int irix_gettimeofday(struct timeval __user *tv) { time_t sec; long nsec, seq; @@ -1088,7 +1044,7 @@ asmlinkage unsigned long irix_mmap32(unsigned long addr, size_t len, int prot, if (max_size > file->f_dentry->d_inode->i_size) { old_pos = sys_lseek (fd, max_size - 1, 0); - sys_write (fd, "", 1); + sys_write (fd, (void __user *) "", 1); sys_lseek (fd, old_pos, 0); } } @@ -1113,7 +1069,7 @@ asmlinkage int irix_madvise(unsigned long addr, int len, int behavior) return -EINVAL; } -asmlinkage int irix_pagelock(char *addr, int len, int op) +asmlinkage int irix_pagelock(char __user *addr, int len, int op) { printk("[%s:%d] Wheee.. irix_pagelock(%p,%d,%d)\n", current->comm, current->pid, addr, len, op); @@ -1153,7 +1109,7 @@ asmlinkage int irix_BSDsetpgrp(int pid, int pgrp) return error; } -asmlinkage int irix_systeminfo(int cmd, char *buf, int cnt) +asmlinkage int irix_systeminfo(int cmd, char __user *buf, int cnt) { printk("[%s:%d] Wheee.. irix_systeminfo(%d,%p,%d)\n", current->comm, current->pid, cmd, buf, cnt); @@ -1169,14 +1125,14 @@ struct iuname { char _unused3[257], _unused4[257], _unused5[257]; }; -asmlinkage int irix_uname(struct iuname *buf) +asmlinkage int irix_uname(struct iuname __user *buf) { down_read(&uts_sem); - if (copy_to_user(system_utsname.sysname, buf->sysname, 65) - || copy_to_user(system_utsname.nodename, buf->nodename, 65) - || copy_to_user(system_utsname.release, buf->release, 65) - || copy_to_user(system_utsname.version, buf->version, 65) - || copy_to_user(system_utsname.machine, buf->machine, 65)) { + if (copy_from_user(vx_new_uts(sysname), buf->sysname, 65) + || copy_from_user(vx_new_uts(nodename), buf->nodename, 65) + || copy_from_user(vx_new_uts(release), buf->release, 65) + || copy_from_user(vx_new_uts(version), buf->version, 65) + || copy_from_user(vx_new_uts(machine), buf->machine, 65)) { return -EFAULT; } up_read(&uts_sem); @@ -1186,7 +1142,7 @@ asmlinkage int irix_uname(struct iuname *buf) #undef DEBUG_XSTAT -static int irix_xstat32_xlate(struct kstat *stat, void *ubuf) +static int irix_xstat32_xlate(struct kstat *stat, void __user *ubuf) { struct xstat32 { u32 st_dev, st_pad1[3], st_ino, st_mode, st_nlink, st_uid, st_gid; @@ -1226,7 +1182,7 @@ static int irix_xstat32_xlate(struct kstat *stat, void *ubuf) return copy_to_user(ubuf, &ub, sizeof(ub)) ? -EFAULT : 0; } -static int irix_xstat64_xlate(struct kstat *stat, void *ubuf) +static int irix_xstat64_xlate(struct kstat *stat, void __user *ubuf) { struct xstat64 { u32 st_dev; s32 st_pad1[3]; @@ -1276,7 +1232,7 @@ static int irix_xstat64_xlate(struct kstat *stat, void *ubuf) return copy_to_user(ubuf, &ks, sizeof(ks)) ? -EFAULT : 0; } -asmlinkage int irix_xstat(int version, char *filename, struct stat *statbuf) +asmlinkage int irix_xstat(int version, char __user *filename, struct stat __user *statbuf) { int retval; struct kstat stat; @@ -1302,7 +1258,7 @@ asmlinkage int irix_xstat(int version, char *filename, struct stat *statbuf) return retval; } -asmlinkage int irix_lxstat(int version, char *filename, struct stat *statbuf) +asmlinkage int irix_lxstat(int version, char __user *filename, struct stat __user *statbuf) { int error; struct kstat stat; @@ -1329,7 +1285,7 @@ asmlinkage int irix_lxstat(int version, char *filename, struct stat *statbuf) return error; } -asmlinkage int irix_fxstat(int version, int fd, struct stat *statbuf) +asmlinkage int irix_fxstat(int version, int fd, struct stat __user *statbuf) { int error; struct kstat stat; @@ -1355,7 +1311,7 @@ asmlinkage int irix_fxstat(int version, int fd, struct stat *statbuf) return error; } -asmlinkage int irix_xmknod(int ver, char *filename, int mode, unsigned dev) +asmlinkage int irix_xmknod(int ver, char __user *filename, int mode, unsigned dev) { int retval; printk("[%s:%d] Wheee.. irix_xmknod(%d,%s,%x,%x)\n", @@ -1375,7 +1331,7 @@ asmlinkage int irix_xmknod(int ver, char *filename, int mode, unsigned dev) return retval; } -asmlinkage int irix_swapctl(int cmd, char *arg) +asmlinkage int irix_swapctl(int cmd, char __user *arg) { printk("[%s:%d] Wheee.. irix_swapctl(%d,%p)\n", current->comm, current->pid, cmd, arg); @@ -1391,7 +1347,7 @@ struct irix_statvfs { char f_fstr[32]; u32 f_filler[16]; }; -asmlinkage int irix_statvfs(char *fname, struct irix_statvfs *buf) +asmlinkage int irix_statvfs(char __user *fname, struct irix_statvfs __user *buf) { struct nameidata nd; struct kstatfs kbuf; @@ -1399,10 +1355,9 @@ asmlinkage int irix_statvfs(char *fname, struct irix_statvfs *buf) printk("[%s:%d] Wheee.. irix_statvfs(%s,%p)\n", current->comm, current->pid, fname, buf); - if (!access_ok(VERIFY_WRITE, buf, sizeof(struct irix_statvfs))) { - error = -EFAULT; - goto out; - } + if (!access_ok(VERIFY_WRITE, buf, sizeof(struct irix_statvfs))) + return -EFAULT; + error = user_path_walk(fname, &nd); if (error) goto out; @@ -1410,27 +1365,25 @@ asmlinkage int irix_statvfs(char *fname, struct irix_statvfs *buf) if (error) goto dput_and_out; - __put_user(kbuf.f_bsize, &buf->f_bsize); - __put_user(kbuf.f_frsize, &buf->f_frsize); - __put_user(kbuf.f_blocks, &buf->f_blocks); - __put_user(kbuf.f_bfree, &buf->f_bfree); - __put_user(kbuf.f_bfree, &buf->f_bavail); /* XXX hackety hack... */ - __put_user(kbuf.f_files, &buf->f_files); - __put_user(kbuf.f_ffree, &buf->f_ffree); - __put_user(kbuf.f_ffree, &buf->f_favail); /* XXX hackety hack... */ + error |= __put_user(kbuf.f_bsize, &buf->f_bsize); + error |= __put_user(kbuf.f_frsize, &buf->f_frsize); + error |= __put_user(kbuf.f_blocks, &buf->f_blocks); + error |= __put_user(kbuf.f_bfree, &buf->f_bfree); + error |= __put_user(kbuf.f_bfree, &buf->f_bavail); /* XXX hackety hack... */ + error |= __put_user(kbuf.f_files, &buf->f_files); + error |= __put_user(kbuf.f_ffree, &buf->f_ffree); + error |= __put_user(kbuf.f_ffree, &buf->f_favail); /* XXX hackety hack... */ #ifdef __MIPSEB__ - __put_user(kbuf.f_fsid.val[1], &buf->f_fsid); + error |= __put_user(kbuf.f_fsid.val[1], &buf->f_fsid); #else - __put_user(kbuf.f_fsid.val[0], &buf->f_fsid); + error |= __put_user(kbuf.f_fsid.val[0], &buf->f_fsid); #endif for (i = 0; i < 16; i++) - __put_user(0, &buf->f_basetype[i]); - __put_user(0, &buf->f_flag); - __put_user(kbuf.f_namelen, &buf->f_namemax); + error |= __put_user(0, &buf->f_basetype[i]); + error |= __put_user(0, &buf->f_flag); + error |= __put_user(kbuf.f_namelen, &buf->f_namemax); for (i = 0; i < 32; i++) - __put_user(0, &buf->f_fstr[i]); - - error = 0; + error |= __put_user(0, &buf->f_fstr[i]); dput_and_out: path_release(&nd); @@ -1438,7 +1391,7 @@ out: return error; } -asmlinkage int irix_fstatvfs(int fd, struct irix_statvfs *buf) +asmlinkage int irix_fstatvfs(int fd, struct irix_statvfs __user *buf) { struct kstatfs kbuf; struct file *file; @@ -1447,10 +1400,9 @@ asmlinkage int irix_fstatvfs(int fd, struct irix_statvfs *buf) printk("[%s:%d] Wheee.. irix_fstatvfs(%d,%p)\n", current->comm, current->pid, fd, buf); - if (!access_ok(VERIFY_WRITE, buf, sizeof(struct irix_statvfs))) { - error = -EFAULT; - goto out; - } + if (!access_ok(VERIFY_WRITE, buf, sizeof(struct irix_statvfs))) + return -EFAULT; + if (!(file = fget(fd))) { error = -EBADF; goto out; @@ -1459,24 +1411,24 @@ asmlinkage int irix_fstatvfs(int fd, struct irix_statvfs *buf) if (error) goto out_f; - __put_user(kbuf.f_bsize, &buf->f_bsize); - __put_user(kbuf.f_frsize, &buf->f_frsize); - __put_user(kbuf.f_blocks, &buf->f_blocks); - __put_user(kbuf.f_bfree, &buf->f_bfree); - __put_user(kbuf.f_bfree, &buf->f_bavail); /* XXX hackety hack... */ - __put_user(kbuf.f_files, &buf->f_files); - __put_user(kbuf.f_ffree, &buf->f_ffree); - __put_user(kbuf.f_ffree, &buf->f_favail); /* XXX hackety hack... */ + error = __put_user(kbuf.f_bsize, &buf->f_bsize); + error |= __put_user(kbuf.f_frsize, &buf->f_frsize); + error |= __put_user(kbuf.f_blocks, &buf->f_blocks); + error |= __put_user(kbuf.f_bfree, &buf->f_bfree); + error |= __put_user(kbuf.f_bfree, &buf->f_bavail); /* XXX hackety hack... */ + error |= __put_user(kbuf.f_files, &buf->f_files); + error |= __put_user(kbuf.f_ffree, &buf->f_ffree); + error |= __put_user(kbuf.f_ffree, &buf->f_favail); /* XXX hackety hack... */ #ifdef __MIPSEB__ - __put_user(kbuf.f_fsid.val[1], &buf->f_fsid); + error |= __put_user(kbuf.f_fsid.val[1], &buf->f_fsid); #else - __put_user(kbuf.f_fsid.val[0], &buf->f_fsid); + error |= __put_user(kbuf.f_fsid.val[0], &buf->f_fsid); #endif for(i = 0; i < 16; i++) - __put_user(0, &buf->f_basetype[i]); - __put_user(0, &buf->f_flag); - __put_user(kbuf.f_namelen, &buf->f_namemax); - __clear_user(&buf->f_fstr, sizeof(buf->f_fstr)); + error |= __put_user(0, &buf->f_basetype[i]); + error |= __put_user(0, &buf->f_flag); + error |= __put_user(kbuf.f_namelen, &buf->f_namemax); + error |= __clear_user(&buf->f_fstr, sizeof(buf->f_fstr)) ? -EFAULT : 0; out_f: fput(file); @@ -1500,7 +1452,7 @@ asmlinkage int irix_sigqueue(int pid, int sig, int code, int val) return -EINVAL; } -asmlinkage int irix_truncate64(char *name, int pad, int size1, int size2) +asmlinkage int irix_truncate64(char __user *name, int pad, int size1, int size2) { int retval; @@ -1533,6 +1485,7 @@ asmlinkage int irix_mmap64(struct pt_regs *regs) int len, prot, flags, fd, off1, off2, error, base = 0; unsigned long addr, pgoff, *sp; struct file *file = NULL; + int err; if (regs->regs[2] == 1000) base = 1; @@ -1542,36 +1495,31 @@ asmlinkage int irix_mmap64(struct pt_regs *regs) prot = regs->regs[base + 6]; if (!base) { flags = regs->regs[base + 7]; - if (!access_ok(VERIFY_READ, sp, (4 * sizeof(unsigned long)))) { - error = -EFAULT; - goto out; - } + if (!access_ok(VERIFY_READ, sp, (4 * sizeof(unsigned long)))) + return -EFAULT; fd = sp[0]; - __get_user(off1, &sp[1]); - __get_user(off2, &sp[2]); + err = __get_user(off1, &sp[1]); + err |= __get_user(off2, &sp[2]); } else { - if (!access_ok(VERIFY_READ, sp, (5 * sizeof(unsigned long)))) { - error = -EFAULT; - goto out; - } - __get_user(flags, &sp[0]); - __get_user(fd, &sp[1]); - __get_user(off1, &sp[2]); - __get_user(off2, &sp[3]); + if (!access_ok(VERIFY_READ, sp, (5 * sizeof(unsigned long)))) + return -EFAULT; + err = __get_user(flags, &sp[0]); + err |= __get_user(fd, &sp[1]); + err |= __get_user(off1, &sp[2]); + err |= __get_user(off2, &sp[3]); } - if (off1 & PAGE_MASK) { - error = -EOVERFLOW; - goto out; - } + if (err) + return err; + + if (off1 & PAGE_MASK) + return -EOVERFLOW; pgoff = (off1 << (32 - PAGE_SHIFT)) | (off2 >> PAGE_SHIFT); if (!(flags & MAP_ANONYMOUS)) { - if (!(file = fget(fd))) { - error = -EBADF; - goto out; - } + if (!(file = fget(fd))) + return -EBADF; /* Ok, bad taste hack follows, try to think in something else when reading this */ @@ -1581,7 +1529,7 @@ asmlinkage int irix_mmap64(struct pt_regs *regs) if (max_size > file->f_dentry->d_inode->i_size) { old_pos = sys_lseek (fd, max_size - 1, 0); - sys_write (fd, "", 1); + sys_write (fd, (void __user *) "", 1); sys_lseek (fd, old_pos, 0); } } @@ -1596,7 +1544,6 @@ asmlinkage int irix_mmap64(struct pt_regs *regs) if (file) fput(file); -out: return error; } @@ -1608,7 +1555,7 @@ asmlinkage int irix_dmi(struct pt_regs *regs) return -EINVAL; } -asmlinkage int irix_pread(int fd, char *buf, int cnt, int off64, +asmlinkage int irix_pread(int fd, char __user *buf, int cnt, int off64, int off1, int off2) { printk("[%s:%d] Wheee.. irix_pread(%d,%p,%d,%d,%d,%d)\n", @@ -1617,7 +1564,7 @@ asmlinkage int irix_pread(int fd, char *buf, int cnt, int off64, return -EINVAL; } -asmlinkage int irix_pwrite(int fd, char *buf, int cnt, int off64, +asmlinkage int irix_pwrite(int fd, char __user *buf, int cnt, int off64, int off1, int off2) { printk("[%s:%d] Wheee.. irix_pwrite(%d,%p,%d,%d,%d,%d)\n", @@ -1649,7 +1596,7 @@ struct irix_statvfs64 { u32 f_filler[16]; }; -asmlinkage int irix_statvfs64(char *fname, struct irix_statvfs64 *buf) +asmlinkage int irix_statvfs64(char __user *fname, struct irix_statvfs64 __user *buf) { struct nameidata nd; struct kstatfs kbuf; @@ -1661,6 +1608,7 @@ asmlinkage int irix_statvfs64(char *fname, struct irix_statvfs64 *buf) error = -EFAULT; goto out; } + error = user_path_walk(fname, &nd); if (error) goto out; @@ -1668,27 +1616,25 @@ asmlinkage int irix_statvfs64(char *fname, struct irix_statvfs64 *buf) if (error) goto dput_and_out; - __put_user(kbuf.f_bsize, &buf->f_bsize); - __put_user(kbuf.f_frsize, &buf->f_frsize); - __put_user(kbuf.f_blocks, &buf->f_blocks); - __put_user(kbuf.f_bfree, &buf->f_bfree); - __put_user(kbuf.f_bfree, &buf->f_bavail); /* XXX hackety hack... */ - __put_user(kbuf.f_files, &buf->f_files); - __put_user(kbuf.f_ffree, &buf->f_ffree); - __put_user(kbuf.f_ffree, &buf->f_favail); /* XXX hackety hack... */ + error = __put_user(kbuf.f_bsize, &buf->f_bsize); + error |= __put_user(kbuf.f_frsize, &buf->f_frsize); + error |= __put_user(kbuf.f_blocks, &buf->f_blocks); + error |= __put_user(kbuf.f_bfree, &buf->f_bfree); + error |= __put_user(kbuf.f_bfree, &buf->f_bavail); /* XXX hackety hack... */ + error |= __put_user(kbuf.f_files, &buf->f_files); + error |= __put_user(kbuf.f_ffree, &buf->f_ffree); + error |= __put_user(kbuf.f_ffree, &buf->f_favail); /* XXX hackety hack... */ #ifdef __MIPSEB__ - __put_user(kbuf.f_fsid.val[1], &buf->f_fsid); + error |= __put_user(kbuf.f_fsid.val[1], &buf->f_fsid); #else - __put_user(kbuf.f_fsid.val[0], &buf->f_fsid); + error |= __put_user(kbuf.f_fsid.val[0], &buf->f_fsid); #endif for(i = 0; i < 16; i++) - __put_user(0, &buf->f_basetype[i]); - __put_user(0, &buf->f_flag); - __put_user(kbuf.f_namelen, &buf->f_namemax); + error |= __put_user(0, &buf->f_basetype[i]); + error |= __put_user(0, &buf->f_flag); + error |= __put_user(kbuf.f_namelen, &buf->f_namemax); for(i = 0; i < 32; i++) - __put_user(0, &buf->f_fstr[i]); - - error = 0; + error |= __put_user(0, &buf->f_fstr[i]); dput_and_out: path_release(&nd); @@ -1696,7 +1642,7 @@ out: return error; } -asmlinkage int irix_fstatvfs64(int fd, struct irix_statvfs *buf) +asmlinkage int irix_fstatvfs64(int fd, struct irix_statvfs __user *buf) { struct kstatfs kbuf; struct file *file; @@ -1717,24 +1663,24 @@ asmlinkage int irix_fstatvfs64(int fd, struct irix_statvfs *buf) if (error) goto out_f; - __put_user(kbuf.f_bsize, &buf->f_bsize); - __put_user(kbuf.f_frsize, &buf->f_frsize); - __put_user(kbuf.f_blocks, &buf->f_blocks); - __put_user(kbuf.f_bfree, &buf->f_bfree); - __put_user(kbuf.f_bfree, &buf->f_bavail); /* XXX hackety hack... */ - __put_user(kbuf.f_files, &buf->f_files); - __put_user(kbuf.f_ffree, &buf->f_ffree); - __put_user(kbuf.f_ffree, &buf->f_favail); /* XXX hackety hack... */ + error = __put_user(kbuf.f_bsize, &buf->f_bsize); + error |= __put_user(kbuf.f_frsize, &buf->f_frsize); + error |= __put_user(kbuf.f_blocks, &buf->f_blocks); + error |= __put_user(kbuf.f_bfree, &buf->f_bfree); + error |= __put_user(kbuf.f_bfree, &buf->f_bavail); /* XXX hackety hack... */ + error |= __put_user(kbuf.f_files, &buf->f_files); + error |= __put_user(kbuf.f_ffree, &buf->f_ffree); + error |= __put_user(kbuf.f_ffree, &buf->f_favail); /* XXX hackety hack... */ #ifdef __MIPSEB__ - __put_user(kbuf.f_fsid.val[1], &buf->f_fsid); + error |= __put_user(kbuf.f_fsid.val[1], &buf->f_fsid); #else - __put_user(kbuf.f_fsid.val[0], &buf->f_fsid); + error |= __put_user(kbuf.f_fsid.val[0], &buf->f_fsid); #endif for(i = 0; i < 16; i++) - __put_user(0, &buf->f_basetype[i]); - __put_user(0, &buf->f_flag); - __put_user(kbuf.f_namelen, &buf->f_namemax); - __clear_user(buf->f_fstr, sizeof(buf->f_fstr[i])); + error |= __put_user(0, &buf->f_basetype[i]); + error |= __put_user(0, &buf->f_flag); + error |= __put_user(kbuf.f_namelen, &buf->f_namemax); + error |= __clear_user(buf->f_fstr, sizeof(buf->f_fstr[i])) ? -EFAULT : 0; out_f: fput(file); @@ -1742,9 +1688,9 @@ out: return error; } -asmlinkage int irix_getmountid(char *fname, unsigned long *midbuf) +asmlinkage int irix_getmountid(char __user *fname, unsigned long __user *midbuf) { - int err = 0; + int err; printk("[%s:%d] irix_getmountid(%s, %p)\n", current->comm, current->pid, fname, midbuf); @@ -1757,7 +1703,7 @@ asmlinkage int irix_getmountid(char *fname, unsigned long *midbuf) * fsid of the filesystem to try and make the right decision, but * we don't have this so for now. XXX */ - err |= __put_user(0, &midbuf[0]); + err = __put_user(0, &midbuf[0]); err |= __put_user(0, &midbuf[1]); err |= __put_user(0, &midbuf[2]); err |= __put_user(0, &midbuf[3]); @@ -1784,8 +1730,8 @@ struct irix_dirent32 { }; struct irix_dirent32_callback { - struct irix_dirent32 *current_dir; - struct irix_dirent32 *previous; + struct irix_dirent32 __user *current_dir; + struct irix_dirent32 __user *previous; int count; int error; }; @@ -1793,13 +1739,13 @@ struct irix_dirent32_callback { #define NAME_OFFSET32(de) ((int) ((de)->d_name - (char *) (de))) #define ROUND_UP32(x) (((x)+sizeof(u32)-1) & ~(sizeof(u32)-1)) -static int irix_filldir32(void *__buf, const char *name, int namlen, - loff_t offset, ino_t ino, unsigned int d_type) +static int irix_filldir32(void *__buf, const char *name, + int namlen, loff_t offset, ino_t ino, unsigned int d_type) { - struct irix_dirent32 *dirent; - struct irix_dirent32_callback *buf = - (struct irix_dirent32_callback *)__buf; + struct irix_dirent32 __user *dirent; + struct irix_dirent32_callback *buf = __buf; unsigned short reclen = ROUND_UP32(NAME_OFFSET32(dirent) + namlen + 1); + int err = 0; #ifdef DEBUG_GETDENTS printk("\nirix_filldir32[reclen<%d>namlen<%d>count<%d>]", @@ -1810,25 +1756,26 @@ static int irix_filldir32(void *__buf, const char *name, int namlen, return -EINVAL; dirent = buf->previous; if (dirent) - __put_user(offset, &dirent->d_off); + err = __put_user(offset, &dirent->d_off); dirent = buf->current_dir; - buf->previous = dirent; - __put_user(ino, &dirent->d_ino); - __put_user(reclen, &dirent->d_reclen); - copy_to_user(dirent->d_name, name, namlen); - __put_user(0, &dirent->d_name[namlen]); - ((char *) dirent) += reclen; + err |= __put_user(dirent, &buf->previous); + err |= __put_user(ino, &dirent->d_ino); + err |= __put_user(reclen, &dirent->d_reclen); + err |= copy_to_user((char __user *)dirent->d_name, name, namlen) ? -EFAULT : 0; + err |= __put_user(0, &dirent->d_name[namlen]); + dirent = (struct irix_dirent32 __user *) ((char __user *) dirent + reclen); + buf->current_dir = dirent; buf->count -= reclen; - return 0; + return err; } -asmlinkage int irix_ngetdents(unsigned int fd, void * dirent, - unsigned int count, int *eob) +asmlinkage int irix_ngetdents(unsigned int fd, void __user * dirent, + unsigned int count, int __user *eob) { struct file *file; - struct irix_dirent32 *lastdirent; + struct irix_dirent32 __user *lastdirent; struct irix_dirent32_callback buf; int error; @@ -1841,7 +1788,7 @@ asmlinkage int irix_ngetdents(unsigned int fd, void * dirent, if (!file) goto out; - buf.current_dir = (struct irix_dirent32 *) dirent; + buf.current_dir = (struct irix_dirent32 __user *) dirent; buf.previous = NULL; buf.count = count; buf.error = 0; @@ -1881,8 +1828,8 @@ struct irix_dirent64 { }; struct irix_dirent64_callback { - struct irix_dirent64 *curr; - struct irix_dirent64 *previous; + struct irix_dirent64 __user *curr; + struct irix_dirent64 __user *previous; int count; int error; }; @@ -1890,37 +1837,44 @@ struct irix_dirent64_callback { #define NAME_OFFSET64(de) ((int) ((de)->d_name - (char *) (de))) #define ROUND_UP64(x) (((x)+sizeof(u64)-1) & ~(sizeof(u64)-1)) -static int irix_filldir64(void * __buf, const char * name, int namlen, - loff_t offset, ino_t ino, unsigned int d_type) +static int irix_filldir64(void *__buf, const char *name, + int namlen, loff_t offset, ino_t ino, unsigned int d_type) { - struct irix_dirent64 *dirent; - struct irix_dirent64_callback * buf = - (struct irix_dirent64_callback *) __buf; + struct irix_dirent64 __user *dirent; + struct irix_dirent64_callback * buf = __buf; unsigned short reclen = ROUND_UP64(NAME_OFFSET64(dirent) + namlen + 1); + int err = 0; - buf->error = -EINVAL; /* only used if we fail.. */ + if (!access_ok(VERIFY_WRITE, buf, sizeof(*buf))) + return -EFAULT; + + if (__put_user(-EINVAL, &buf->error)) /* only used if we fail.. */ + return -EFAULT; if (reclen > buf->count) return -EINVAL; dirent = buf->previous; if (dirent) - __put_user(offset, &dirent->d_off); + err = __put_user(offset, &dirent->d_off); dirent = buf->curr; buf->previous = dirent; - __put_user(ino, &dirent->d_ino); - __put_user(reclen, &dirent->d_reclen); - __copy_to_user(dirent->d_name, name, namlen); - __put_user(0, &dirent->d_name[namlen]); - ((char *) dirent) += reclen; + err |= __put_user(ino, &dirent->d_ino); + err |= __put_user(reclen, &dirent->d_reclen); + err |= __copy_to_user((char __user *)dirent->d_name, name, namlen) + ? -EFAULT : 0; + err |= __put_user(0, &dirent->d_name[namlen]); + + dirent = (struct irix_dirent64 __user *) ((char __user *) dirent + reclen); + buf->curr = dirent; buf->count -= reclen; - return 0; + return err; } -asmlinkage int irix_getdents64(int fd, void *dirent, int cnt) +asmlinkage int irix_getdents64(int fd, void __user *dirent, int cnt) { struct file *file; - struct irix_dirent64 *lastdirent; + struct irix_dirent64 __user *lastdirent; struct irix_dirent64_callback buf; int error; @@ -1940,7 +1894,7 @@ asmlinkage int irix_getdents64(int fd, void *dirent, int cnt) if (cnt < (sizeof(struct irix_dirent64) + 255)) goto out_f; - buf.curr = (struct irix_dirent64 *) dirent; + buf.curr = (struct irix_dirent64 __user *) dirent; buf.previous = NULL; buf.count = cnt; buf.error = 0; @@ -1952,7 +1906,8 @@ asmlinkage int irix_getdents64(int fd, void *dirent, int cnt) error = buf.error; goto out_f; } - lastdirent->d_off = (u64) file->f_pos; + if (put_user(file->f_pos, &lastdirent->d_off)) + return -EFAULT; #ifdef DEBUG_GETDENTS printk("returning %d\n", cnt - buf.count); #endif @@ -1964,10 +1919,10 @@ out: return error; } -asmlinkage int irix_ngetdents64(int fd, void *dirent, int cnt, int *eob) +asmlinkage int irix_ngetdents64(int fd, void __user *dirent, int cnt, int *eob) { struct file *file; - struct irix_dirent64 *lastdirent; + struct irix_dirent64 __user *lastdirent; struct irix_dirent64_callback buf; int error; @@ -1989,7 +1944,7 @@ asmlinkage int irix_ngetdents64(int fd, void *dirent, int cnt, int *eob) goto out_f; *eob = 0; - buf.curr = (struct irix_dirent64 *) dirent; + buf.curr = (struct irix_dirent64 __user *) dirent; buf.previous = NULL; buf.count = cnt; buf.error = 0; @@ -2001,7 +1956,8 @@ asmlinkage int irix_ngetdents64(int fd, void *dirent, int cnt, int *eob) error = buf.error; goto out_f; } - lastdirent->d_off = (u64) file->f_pos; + if (put_user(file->f_pos, &lastdirent->d_off)) + return -EFAULT; #ifdef DEBUG_GETDENTS printk("eob=%d returning %d\n", *eob, cnt - buf.count); #endif @@ -2064,14 +2020,14 @@ out: return retval; } -asmlinkage int irix_utssys(char *inbuf, int arg, int type, char *outbuf) +asmlinkage int irix_utssys(char __user *inbuf, int arg, int type, char __user *outbuf) { int retval; switch(type) { case 0: /* uname() */ - retval = irix_uname((struct iuname *)inbuf); + retval = irix_uname((struct iuname __user *)inbuf); goto out; case 2: