Input: keyboard - fix potential out of bound access to key_map

[safe/jmp/linux-2.6] / drivers / char / raw.c

diff --git a/drivers/char/raw.c b/drivers/char/raw.c
index 89b718e..47b8cf2 100644 (file)
--- a/drivers/char/raw.c
+++ b/drivers/char/raw.c
@@ -19,6 +19,7 @@
 #include <linux/cdev.h>
 #include <linux/device.h>
 #include <linux/mutex.h>
+#include <linux/smp_lock.h>
 
 #include <asm/uaccess.h>
 
@@ -53,6 +54,7 @@ static int raw_open(struct inode *inode, struct file *filp)
                return 0;
        }
 
+       lock_kernel();
        mutex_lock(&raw_mutex);
 
        /*
@@ -75,10 +77,11 @@ static int raw_open(struct inode *inode, struct file *filp)
        filp->f_flags |= O_DIRECT;
        filp->f_mapping = bdev->bd_inode->i_mapping;
        if (++raw_devices[minor].inuse == 1)
-               filp->f_dentry->d_inode->i_mapping =
+               filp->f_path.dentry->d_inode->i_mapping =
                        bdev->bd_inode->i_mapping;
        filp->private_data = bdev;
        mutex_unlock(&raw_mutex);
+       unlock_kernel();
        return 0;
 
 out2:
@@ -127,9 +130,9 @@ raw_ioctl(struct inode *inode, struct file *filp,
 
 static void bind_device(struct raw_config_request *rq)
 {
-       class_device_destroy(raw_class, MKDEV(RAW_MAJOR, rq->raw_minor));
-       class_device_create(raw_class, NULL, MKDEV(RAW_MAJOR, rq->raw_minor),
-                                     NULL, "raw%d", rq->raw_minor);
+       device_destroy(raw_class, MKDEV(RAW_MAJOR, rq->raw_minor));
+       device_create_drvdata(raw_class, NULL, MKDEV(RAW_MAJOR, rq->raw_minor),
+                             NULL, "raw%d", rq->raw_minor);
 }
 
 /*
@@ -154,7 +157,7 @@ static int raw_ctl_ioctl(struct inode *inode, struct file *filp,
                        goto out;
                }
 
-               if (rq.raw_minor < 0 || rq.raw_minor >= MAX_RAW_MINORS) {
+               if (rq.raw_minor <= 0 || rq.raw_minor >= MAX_RAW_MINORS) {
                        err = -EINVAL;
                        goto out;
                }
@@ -200,7 +203,7 @@ static int raw_ctl_ioctl(struct inode *inode, struct file *filp,
                        if (rq.block_major == 0 && rq.block_minor == 0) {
                                /* unbind */
                                rawdev->binding = NULL;
-                               class_device_destroy(raw_class,
+                               device_destroy(raw_class,
                                                MKDEV(RAW_MAJOR, rq.raw_minor));
                        } else {
                                rawdev->binding = bdget(dev);
@@ -255,10 +258,7 @@ static const struct file_operations raw_ctl_fops = {
        .owner  =       THIS_MODULE,
 };
 
-static struct cdev raw_cdev = {
-       .kobj   =       {.name = "raw", },
-       .owner  =       THIS_MODULE,
-};
+static struct cdev raw_cdev;
 
 static int __init raw_init(void)
 {
@@ -283,7 +283,8 @@ static int __init raw_init(void)
                ret = PTR_ERR(raw_class);
                goto error_region;
        }
-       class_device_create(raw_class, NULL, MKDEV(RAW_MAJOR, 0), NULL, "rawctl");
+       device_create_drvdata(raw_class, NULL, MKDEV(RAW_MAJOR, 0), NULL,
+                             "rawctl");
 
        return 0;
 
@@ -295,7 +296,7 @@ error:
 
 static void __exit raw_exit(void)
 {
-       class_device_destroy(raw_class, MKDEV(RAW_MAJOR, 0));
+       device_destroy(raw_class, MKDEV(RAW_MAJOR, 0));
        class_destroy(raw_class);
        cdev_del(&raw_cdev);
        unregister_chrdev_region(MKDEV(RAW_MAJOR, 0), MAX_RAW_MINORS);