revert drivers/hid/uhid.c of commit 522c0bb37a66e65b704a4bd0f1bee7fec526dd32

  solve uhid Bad address error in 64bit cpu

diff --git a/drivers/hid/uhid.c b/drivers/hid/uhid.c
index 714cd8cc9579b6cd3c71b8a2aebb140e089f27e6..0bb3bb889b7191a84cbf66cabe59c1170af368be 100644 (file)
--- a/drivers/hid/uhid.c
+++ b/drivers/hid/uhid.c
@@ -11,6 +11,7 @@
  */
 
 #include <linux/atomic.h>
+#include <linux/compat.h>
 #include <linux/device.h>
 #include <linux/fs.h>
 #include <linux/hid.h>
@@ -276,6 +277,94 @@ static struct hid_ll_driver uhid_hid_driver = {
        .parse = uhid_hid_parse,
 };
 
+#ifdef CONFIG_COMPAT
+
+/* Apparently we haven't stepped on these rakes enough times yet. */
+struct uhid_create_req_compat {
+       __u8 name[128];
+       __u8 phys[64];
+       __u8 uniq[64];
+
+       compat_uptr_t rd_data;
+       __u16 rd_size;
+
+       __u16 bus;
+       __u32 vendor;
+       __u32 product;
+       __u32 version;
+       __u32 country;
+} __attribute__((__packed__));
+
+static int uhid_event_from_user(const char __user *buffer, size_t len,
+                               struct uhid_event *event)
+{
+       if (is_compat_task()) {
+               u32 type;
+
+               if (get_user(type, buffer))
+                       return -EFAULT;
+
+               if (type == UHID_CREATE) {
+                       /*
+                        * This is our messed up request with compat pointer.
+                        * It is largish (more than 256 bytes) so we better
+                        * allocate it from the heap.
+                        */
+                       struct uhid_create_req_compat *compat;
+
+                       compat = kzalloc(sizeof(*compat), GFP_KERNEL);
+                       if (!compat)
+                               return -ENOMEM;
+
+                       buffer += sizeof(type);
+                       len -= sizeof(type);
+                       if (copy_from_user(compat, buffer,
+                                          min(len, sizeof(*compat)))) {
+                               kfree(compat);
+                               return -EFAULT;
+                       }
+
+                       /* Shuffle the data over to proper structure */
+                       event->type = type;
+
+                       memcpy(event->u.create.name, compat->name,
+                               sizeof(compat->name));
+                       memcpy(event->u.create.phys, compat->phys,
+                               sizeof(compat->phys));
+                       memcpy(event->u.create.uniq, compat->uniq,
+                               sizeof(compat->uniq));
+
+                       event->u.create.rd_data = compat_ptr(compat->rd_data);
+                       event->u.create.rd_size = compat->rd_size;
+
+                       event->u.create.bus = compat->bus;
+                       event->u.create.vendor = compat->vendor;
+                       event->u.create.product = compat->product;
+                       event->u.create.version = compat->version;
+                       event->u.create.country = compat->country;
+
+                       kfree(compat);
+                       return 0;
+               }
+               /* All others can be copied directly */
+       }
+
+       if (copy_from_user(event, buffer, min(len, sizeof(*event))))
+               return -EFAULT;
+
+       return 0;
+}
+#else
+static int uhid_event_from_user(const char __user *buffer, size_t len,
+                               struct uhid_event *event)
+{
+       if (copy_from_user(event, buffer, min(len, sizeof(*event))))
+               return -EFAULT;
+
+       return 0;
+}
+#endif
+
 static int uhid_dev_create(struct uhid_device *uhid,
                           const struct uhid_event *ev)
 {
@@ -498,10 +587,10 @@ static ssize_t uhid_char_write(struct file *file, const char __user *buffer,
 
        memset(&uhid->input_buf, 0, sizeof(uhid->input_buf));
        len = min(count, sizeof(uhid->input_buf));
-       if (copy_from_user(&uhid->input_buf, buffer, len)) {
-               ret = -EFAULT;
+
+       ret = uhid_event_from_user(buffer, len, &uhid->input_buf);
+       if (ret)
                goto unlock;
-       }
 
        switch (uhid->input_buf.type) {
        case UHID_CREATE:
@@ -551,7 +640,7 @@ static const struct file_operations uhid_fops = {
 
 static struct miscdevice uhid_misc = {
        .fops           = &uhid_fops,
-       .minor          = MISC_DYNAMIC_MINOR,
+       .minor          = UHID_MINOR,
        .name           = UHID_NAME,
 };
 
@@ -570,3 +659,5 @@ module_exit(uhid_exit);
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("David Herrmann <dh.herrmann@gmail.com>");
 MODULE_DESCRIPTION("User-space I/O driver support for HID subsystem");
+MODULE_ALIAS_MISCDEV(UHID_MINOR);
+MODULE_ALIAS("devname:" UHID_NAME);