VServer 1.9.2 (patch-2.6.8.1-vs1.9.2.diff)

[linux-2.6.git] / drivers / ieee1394 / video1394.c

diff --git a/drivers/ieee1394/video1394.c b/drivers/ieee1394/video1394.c
index 7a757fc..fd40358 100644 (file)
--- a/drivers/ieee1394/video1394.c
+++ b/drivers/ieee1394/video1394.c
@@ -705,6 +705,7 @@ static int video1394_ioctl(struct inode *inode, struct file *file,
        struct file_ctx *ctx = (struct file_ctx *)file->private_data;
        struct ti_ohci *ohci = ctx->ohci;
        unsigned long flags;
+       void __user *argp = (void __user *)arg;
 
        switch(cmd)
        {
@@ -716,7 +717,7 @@ static int video1394_ioctl(struct inode *inode, struct file *file,
                struct dma_iso_ctx *d;
                int i;
 
-               if (copy_from_user(&v, (void *)arg, sizeof(v)))
+               if (copy_from_user(&v, argp, sizeof(v)))
                        return -EFAULT;
 
                /* if channel < 0, find lowest available one */
@@ -813,7 +814,7 @@ static int video1394_ioctl(struct inode *inode, struct file *file,
                              v.channel);
                }
 
-               if (copy_to_user((void *)arg, &v, sizeof(v)))
+               if (copy_to_user(argp, &v, sizeof(v)))
                        return -EFAULT;
 
                return 0;
@@ -825,7 +826,7 @@ static int video1394_ioctl(struct inode *inode, struct file *file,
                u64 mask;
                struct dma_iso_ctx *d;
 
-               if (copy_from_user(&channel, (void *)arg, sizeof(int)))
+               if (copy_from_user(&channel, argp, sizeof(int)))
                        return -EFAULT;
 
                if (channel<0 || channel>(ISO_CHANNELS-1)) {
@@ -860,7 +861,7 @@ static int video1394_ioctl(struct inode *inode, struct file *file,
                struct video1394_wait v;
                struct dma_iso_ctx *d;
 
-               if (copy_from_user(&v, (void *)arg, sizeof(v)))
+               if (copy_from_user(&v, argp, sizeof(v)))
                        return -EFAULT;
 
                d = find_ctx(&ctx->context_list, OHCI_ISO_RECEIVE, v.channel);
@@ -923,7 +924,7 @@ static int video1394_ioctl(struct inode *inode, struct file *file,
                struct dma_iso_ctx *d;
                int i;
 
-               if (copy_from_user(&v, (void *)arg, sizeof(v)))
+               if (copy_from_user(&v, argp, sizeof(v)))
                        return -EFAULT;
 
                d = find_ctx(&ctx->context_list, OHCI_ISO_RECEIVE, v.channel);
@@ -994,7 +995,7 @@ static int video1394_ioctl(struct inode *inode, struct file *file,
                spin_unlock_irqrestore(&d->lock, flags);
 
                v.buffer=i;
-               if (copy_to_user((void *)arg, &v, sizeof(v)))
+               if (copy_to_user(argp, &v, sizeof(v)))
                        return -EFAULT;
 
                return 0;
@@ -1002,12 +1003,10 @@ static int video1394_ioctl(struct inode *inode, struct file *file,
        case VIDEO1394_IOC_TALK_QUEUE_BUFFER:
        {
                struct video1394_wait v;
-               struct video1394_queue_variable qv;
+               unsigned int *psizes = NULL;
                struct dma_iso_ctx *d;
 
-               qv.packet_sizes = NULL;
-
-               if (copy_from_user(&v, (void *)arg, sizeof(v)))
+               if (copy_from_user(&v, argp, sizeof(v)))
                        return -EFAULT;
 
                d = find_ctx(&ctx->context_list, OHCI_ISO_TRANSMIT, v.channel);
@@ -1020,22 +1019,21 @@ static int video1394_ioctl(struct inode *inode, struct file *file,
                }
 
                if (d->flags & VIDEO1394_VARIABLE_PACKET_SIZE) {
-                       unsigned int *psizes;
                        int buf_size = d->nb_cmd * sizeof(unsigned int);
+                       struct video1394_queue_variable __user *p = argp;
+                       unsigned int __user *qv;
 
-                       if (copy_from_user(&qv, (void *)arg, sizeof(qv)))
+                       if (get_user(qv, &p->packet_sizes))
                                return -EFAULT;
 
                        psizes = kmalloc(buf_size, GFP_KERNEL);
                        if (!psizes)
                                return -ENOMEM;
 
-                       if (copy_from_user(psizes, qv.packet_sizes, buf_size)) {
+                       if (copy_from_user(psizes, qv, buf_size)) {
                                kfree(psizes);
                                return -EFAULT;
                        }
-
-                       qv.packet_sizes = psizes;
                }
 
                spin_lock_irqsave(&d->lock,flags);
@@ -1044,14 +1042,14 @@ static int video1394_ioctl(struct inode *inode, struct file *file,
                        PRINT(KERN_ERR, ohci->host->id,
                              "Buffer %d is already used",v.buffer);
                        spin_unlock_irqrestore(&d->lock,flags);
-                       if (qv.packet_sizes)
-                               kfree(qv.packet_sizes);
+                       if (psizes)
+                               kfree(psizes);
                        return -EFAULT;
                }
 
                if (d->flags & VIDEO1394_VARIABLE_PACKET_SIZE) {
                        initialize_dma_it_prg_var_packet_queue(
-                               d, v.buffer, qv.packet_sizes,
+                               d, v.buffer, psizes,
                                ohci);
                }
 
@@ -1100,8 +1098,8 @@ static int video1394_ioctl(struct inode *inode, struct file *file,
                        }
                }
 
-               if (qv.packet_sizes)
-                       kfree(qv.packet_sizes);
+               if (psizes)
+                       kfree(psizes);
 
                return 0;
 
@@ -1111,7 +1109,7 @@ static int video1394_ioctl(struct inode *inode, struct file *file,
                struct video1394_wait v;
                struct dma_iso_ctx *d;
 
-               if (copy_from_user(&v, (void *)arg, sizeof(v)))
+               if (copy_from_user(&v, argp, sizeof(v)))
                        return -EFAULT;
 
                d = find_ctx(&ctx->context_list, OHCI_ISO_TRANSMIT, v.channel);
@@ -1338,6 +1336,7 @@ struct video1394_wait32 {
 static int video1394_wr_wait32(unsigned int fd, unsigned int cmd, unsigned long arg,
                               struct file *file)
 {
+        struct video1394_wait32 __user *argp = (void __user *)arg;
         struct video1394_wait32 wait32;
         struct video1394_wait wait;
         mm_segment_t old_fs;
@@ -1346,7 +1345,7 @@ static int video1394_wr_wait32(unsigned int fd, unsigned int cmd, unsigned long
        if (file->f_op->ioctl != video1394_ioctl)
                return -EFAULT;
 
-        if (copy_from_user(&wait32, (void *)arg, sizeof(wait32)))
+        if (copy_from_user(&wait32, argp, sizeof(wait32)))
                 return -EFAULT;
 
         wait.channel = wait32.channel;
@@ -1372,7 +1371,7 @@ static int video1394_wr_wait32(unsigned int fd, unsigned int cmd, unsigned long
                 wait32.filltime.tv_sec = (int)wait.filltime.tv_sec;
                 wait32.filltime.tv_usec = (int)wait.filltime.tv_usec;
 
-                if (copy_to_user((struct video1394_wait32 *)arg, &wait32, sizeof(wait32)))
+                if (copy_to_user(argp, &wait32, sizeof(wait32)))
                         ret = -EFAULT;
         }
 
@@ -1390,7 +1389,7 @@ static int video1394_w_wait32(unsigned int fd, unsigned int cmd, unsigned long a
        if (file->f_op->ioctl != video1394_ioctl)
                return -EFAULT;
 
-        if (copy_from_user(&wait32, (void *)arg, sizeof(wait32)))
+        if (copy_from_user(&wait32, (void __user *)arg, sizeof(wait32)))
                 return -EFAULT;
 
         wait.channel = wait32.channel;