luck/tmp_suning_uos_patched
1
0
Fork 1
Code Issues Pull Requests Packages Projects Releases Wiki Activity

[MTD] mtdchar.c: ioctl always returns 0 as size written for ppc64

Browse Source 
"include/linux/mtd/mtd.h" declares "mtd_oob_ops.retlen" as size_t, which
is 64 bits on targets with a 64 bit addressing. The MEMWRITEOOB ioctl
calls copy_to_user() to write it back to "mtd_oob_buf.length", which is
declared in "include/linux/mtd-abi.h" as uint32_t. Since powerpc is a
big endian architecture, this only copies the upper 32 bits of the
address, which is always 0.

Signed-off-by: David Scidmore <dscidmore@xes-inc.com>
Signed-off-by: David Woodhouse <dwmw2@infradead.org>
This commit is contained in:
David Scidmore 2007-12-11 17:44:30 -06:00 committed by David Woodhouse
parent 4b3cc34061
commit e9d8d48253
1 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
drivers/mtd/mtdchar.c
View File

@ -483,6 +483,7 @@ static int mtd_ioctl(struct inode *inode, struct file *file,
{
struct mtd_oob_buf buf;
struct mtd_oob_ops ops;
uint32_t retlen;
if(!(file->f_mode & 2))
return -EPERM;
@ -522,8 +523,11 @@ static int mtd_ioctl(struct inode *inode, struct file *file,
buf.start &= ~(mtd->oobsize - 1);
ret = mtd->write_oob(mtd, buf.start, &ops);
if (copy_to_user(argp + sizeof(uint32_t), &ops.oobretlen,
sizeof(uint32_t)))
if (ops.oobretlen > 0xFFFFFFFFU)
ret = -EOVERFLOW;
retlen = ops.oobretlen;
if (copy_to_user(&((struct mtd_oob_buf *)argp)->length,
&retlen, sizeof(buf.length)))
ret = -EFAULT;
kfree(ops.oobbuf);