ipheth: potential null dereferences on error path
[safe/jmp/linux-2.6] / drivers / block / xd.c
index 68b6d7b..18a80ff 100644 (file)
 #include <linux/blkdev.h>
 #include <linux/blkpg.h>
 #include <linux/delay.h>
+#include <linux/io.h>
+#include <linux/gfp.h>
 
 #include <asm/system.h>
-#include <asm/io.h>
 #include <asm/uaccess.h>
 #include <asm/dma.h>
 
@@ -128,9 +129,12 @@ static DEFINE_SPINLOCK(xd_lock);
 
 static struct gendisk *xd_gendisk[2];
 
-static struct block_device_operations xd_fops = {
+static int xd_getgeo(struct block_device *bdev, struct hd_geometry *geo);
+
+static const struct block_device_operations xd_fops = {
        .owner  = THIS_MODULE,
-       .ioctl  = xd_ioctl,
+       .locked_ioctl   = xd_ioctl,
+       .getgeo = xd_getgeo,
 };
 static DECLARE_WAIT_QUEUE_HEAD(xd_wait_int);
 static u_char xd_drives, xd_irq = 5, xd_dma = 3, xd_maxsectors;
@@ -166,13 +170,6 @@ static int __init xd_init(void)
 
        init_timer (&xd_watchdog_int); xd_watchdog_int.function = xd_watchdog;
 
-       if (!xd_dma_buffer)
-               xd_dma_buffer = (char *)xd_dma_mem_alloc(xd_maxsectors * 0x200);
-       if (!xd_dma_buffer) {
-               printk(KERN_ERR "xd: Out of memory.\n");
-               return -ENOMEM;
-       }
-
        err = -EBUSY;
        if (register_blkdev(XT_DISK_MAJOR, "xd"))
                goto out1;
@@ -199,6 +196,19 @@ static int __init xd_init(void)
                        xd_drives,xd_drives == 1 ? "" : "s",xd_irq,xd_dma);
        }
 
+       /*
+        * With the drive detected, xd_maxsectors should now be known.
+        * If xd_maxsectors is 0, nothing was detected and we fall through
+        * to return -ENODEV
+        */
+       if (!xd_dma_buffer && xd_maxsectors) {
+               xd_dma_buffer = (char *)xd_dma_mem_alloc(xd_maxsectors * 0x200);
+               if (!xd_dma_buffer) {
+                       printk(KERN_ERR "xd: Out of memory.\n");
+                       goto out3;
+               }
+       }
+
        err = -ENODEV;
        if (!xd_drives)
                goto out3;
@@ -212,7 +222,6 @@ static int __init xd_init(void)
                disk->major = XT_DISK_MAJOR;
                disk->first_minor = i<<6;
                sprintf(disk->disk_name, "xd%c", i+'a');
-               sprintf(disk->devfs_name, "xd/target%d", i);
                disk->fops = &xd_fops;
                disk->private_data = p;
                disk->queue = xd_queue;
@@ -234,7 +243,7 @@ static int __init xd_init(void)
        }
 
        /* xd_maxsectors depends on controller - so set after detection */
-       blk_queue_max_sectors(xd_queue, xd_maxsectors);
+       blk_queue_max_hw_sectors(xd_queue, xd_maxsectors);
 
        for (i = 0; i < xd_drives; i++)
                add_disk(xd_gendisk[i]);
@@ -247,15 +256,17 @@ out4:
        for (i = 0; i < xd_drives; i++)
                put_disk(xd_gendisk[i]);
 out3:
-       release_region(xd_iobase,4);
+       if (xd_maxsectors)
+               release_region(xd_iobase,4);
+
+       if (xd_dma_buffer)
+               xd_dma_mem_free((unsigned long)xd_dma_buffer,
+                               xd_maxsectors * 0x200);
 out2:
        blk_cleanup_queue(xd_queue);
 out1a:
        unregister_blkdev(XT_DISK_MAJOR, "xd");
 out1:
-       if (xd_dma_buffer)
-               xd_dma_mem_free((unsigned long)xd_dma_buffer,
-                               xd_maxsectors * 0x200);
        return err;
 Enomem:
        err = -ENOMEM;
@@ -276,11 +287,11 @@ static u_char __init xd_detect (u_char *controller, unsigned int *address)
                return(1);
        }
 
-       for (i = 0; i < (sizeof(xd_bases) / sizeof(xd_bases[0])); i++) {
+       for (i = 0; i < ARRAY_SIZE(xd_bases); i++) {
                void __iomem *p = ioremap(xd_bases[i], 0x2000);
                if (!p)
                        continue;
-               for (j = 1; j < (sizeof(xd_sigs) / sizeof(xd_sigs[0])); j++) {
+               for (j = 1; j < ARRAY_SIZE(xd_sigs); j++) {
                        const char *s = xd_sigs[j].string;
                        if (check_signature(p + xd_sigs[j].offset, s, strlen(s))) {
                                *controller = j;
@@ -296,56 +307,49 @@ static u_char __init xd_detect (u_char *controller, unsigned int *address)
 }
 
 /* do_xd_request: handle an incoming request */
-static void do_xd_request (request_queue_t * q)
+static void do_xd_request (struct request_queue * q)
 {
        struct request *req;
 
        if (xdc_busy)
                return;
 
-       while ((req = elv_next_request(q)) != NULL) {
-               unsigned block = req->sector;
-               unsigned count = req->nr_sectors;
-               int rw = rq_data_dir(req);
+       req = blk_fetch_request(q);
+       while (req) {
+               unsigned block = blk_rq_pos(req);
+               unsigned count = blk_rq_cur_sectors(req);
                XD_INFO *disk = req->rq_disk->private_data;
-               int res = 0;
+               int res = -EIO;
                int retry;
 
-               if (!(req->flags & REQ_CMD)) {
-                       end_request(req, 0);
-                       continue;
-               }
-               if (block + count > get_capacity(req->rq_disk)) {
-                       end_request(req, 0);
-                       continue;
-               }
-               if (rw != READ && rw != WRITE) {
-                       printk("do_xd_request: unknown request\n");
-                       end_request(req, 0);
-                       continue;
-               }
+               if (!blk_fs_request(req))
+                       goto done;
+               if (block + count > get_capacity(req->rq_disk))
+                       goto done;
                for (retry = 0; (retry < XD_RETRIES) && !res; retry++)
-                       res = xd_readwrite(rw, disk, req->buffer, block, count);
-               end_request(req, res);  /* wrap up, 0 = fail, 1 = success */
+                       res = xd_readwrite(rq_data_dir(req), disk, req->buffer,
+                                          block, count);
+       done:
+               /* wrap up, 0 = success, -errno = fail */
+               if (!__blk_end_request_cur(req, res))
+                       req = blk_fetch_request(q);
        }
 }
 
-/* xd_ioctl: handle device ioctl's */
-static int xd_ioctl (struct inode *inode,struct file *file,u_int cmd,u_long arg)
+static int xd_getgeo(struct block_device *bdev, struct hd_geometry *geo)
 {
-       XD_INFO *p = inode->i_bdev->bd_disk->private_data;
+       XD_INFO *p = bdev->bd_disk->private_data;
 
+       geo->heads = p->heads;
+       geo->sectors = p->sectors;
+       geo->cylinders = p->cylinders;
+       return 0;
+}
+
+/* xd_ioctl: handle device ioctl's */
+static int xd_ioctl(struct block_device *bdev, fmode_t mode, u_int cmd, u_long arg)
+{
        switch (cmd) {
-               case HDIO_GETGEO:
-               {
-                       struct hd_geometry g;
-                       struct hd_geometry __user *geom= (void __user *)arg;
-                       g.heads = p->heads;
-                       g.sectors = p->sectors;
-                       g.cylinders = p->cylinders;
-                       g.start = get_start_sect(inode->i_bdev);
-                       return copy_to_user(geom, &g, sizeof(g)) ? -EFAULT : 0;
-               }
                case HDIO_SET_DMA:
                        if (!capable(CAP_SYS_ADMIN)) return -EACCES;
                        if (xdc_busy) return -EBUSY;
@@ -418,7 +422,7 @@ static int xd_readwrite (u_char operation,XD_INFO *p,char *buffer,u_int block,u_
                                printk("xd%c: %s timeout, recalibrating drive\n",'a'+drive,(operation == READ ? "read" : "write"));
                                xd_recalibrate(drive);
                                spin_lock_irq(&xd_lock);
-                               return (0);
+                               return -EIO;
                        case 2:
                                if (sense[0] & 0x30) {
                                        printk("xd%c: %s - ",'a'+drive,(operation == READ ? "reading" : "writing"));
@@ -439,7 +443,7 @@ static int xd_readwrite (u_char operation,XD_INFO *p,char *buffer,u_int block,u_
                                else
                                        printk(" - no valid disk address\n");
                                spin_lock_irq(&xd_lock);
-                               return (0);
+                               return -EIO;
                }
                if (xd_dma_buffer)
                        for (i=0; i < (temp * 0x200); i++)
@@ -448,7 +452,7 @@ static int xd_readwrite (u_char operation,XD_INFO *p,char *buffer,u_int block,u_
                count -= temp, buffer += temp * 0x200, block += temp;
        }
        spin_lock_irq(&xd_lock);
-       return (1);
+       return 0;
 }
 
 /* xd_recalibrate: recalibrate a given drive and reset controller if necessary */
@@ -462,8 +466,7 @@ static void xd_recalibrate (u_char drive)
 }
 
 /* xd_interrupt_handler: interrupt service routine */
-static irqreturn_t xd_interrupt_handler(int irq, void *dev_id,
-                                       struct pt_regs *regs)
+static irqreturn_t xd_interrupt_handler(int irq, void *dev_id)
 {
        if (inb(XD_STATUS) & STAT_INTERRUPT) {                                                  /* check if it was our device */
 #ifdef DEBUG_OTHER
@@ -1017,7 +1020,7 @@ static void __init do_xd_setup (int *integers)
                case 2: if ((integers[2] > 0) && (integers[2] < 16))
                                xd_irq = integers[2];
                case 1: xd_override = 1;
-                       if ((integers[1] >= 0) && (integers[1] < (sizeof(xd_sigs) / sizeof(xd_sigs[0]))))
+                       if ((integers[1] >= 0) && (integers[1] < ARRAY_SIZE(xd_sigs)))
                                xd_type = integers[1];
                case 0: break;
                default:printk("xd: too many parameters for xd\n");