1 /*
2  * comedi/comedi_compat32.c
3  * 32-bit ioctl compatibility for 64-bit comedi kernel module.
4  *
5  * Author: Ian Abbott, MEV Ltd. <abbotti@mev.co.uk>
6  * Copyright (C) 2007 MEV Ltd. <http://www.mev.co.uk/>
7  *
8  * COMEDI - Linux Control and Measurement Device Interface
9  * Copyright (C) 1997-2007 David A. Schleef <ds@schleef.org>
10  *
11  * This program is free software; you can redistribute it and/or modify
12  * it under the terms of the GNU General Public License as published by
13  * the Free Software Foundation; either version 2 of the License, or
14  * (at your option) any later version.
15  *
16  * This program is distributed in the hope that it will be useful,
17  * but WITHOUT ANY WARRANTY; without even the implied warranty of
18  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
19  * GNU General Public License for more details.
20  */
21 
22 #include <linux/uaccess.h>
23 #include <linux/compat.h>
24 #include <linux/fs.h>
25 #include "comedi.h"
26 #include "comedi_compat32.h"
27 
28 #define COMEDI32_CHANINFO _IOR(CIO, 3, struct comedi32_chaninfo_struct)
29 #define COMEDI32_RANGEINFO _IOR(CIO, 8, struct comedi32_rangeinfo_struct)
30 /*
31  * N.B. COMEDI32_CMD and COMEDI_CMD ought to use _IOWR, not _IOR.
32  * It's too late to change it now, but it only affects the command number.
33  */
34 #define COMEDI32_CMD _IOR(CIO, 9, struct comedi32_cmd_struct)
35 /*
36  * N.B. COMEDI32_CMDTEST and COMEDI_CMDTEST ought to use _IOWR, not _IOR.
37  * It's too late to change it now, but it only affects the command number.
38  */
39 #define COMEDI32_CMDTEST _IOR(CIO, 10, struct comedi32_cmd_struct)
40 #define COMEDI32_INSNLIST _IOR(CIO, 11, struct comedi32_insnlist_struct)
41 #define COMEDI32_INSN _IOR(CIO, 12, struct comedi32_insn_struct)
42 
43 struct comedi32_chaninfo_struct {
44 	unsigned int subdev;
45 	compat_uptr_t maxdata_list;	/* 32-bit 'unsigned int *' */
46 	compat_uptr_t flaglist;		/* 32-bit 'unsigned int *' */
47 	compat_uptr_t rangelist;	/* 32-bit 'unsigned int *' */
48 	unsigned int unused[4];
49 };
50 
51 struct comedi32_rangeinfo_struct {
52 	unsigned int range_type;
53 	compat_uptr_t range_ptr;	/* 32-bit 'void *' */
54 };
55 
56 struct comedi32_cmd_struct {
57 	unsigned int subdev;
58 	unsigned int flags;
59 	unsigned int start_src;
60 	unsigned int start_arg;
61 	unsigned int scan_begin_src;
62 	unsigned int scan_begin_arg;
63 	unsigned int convert_src;
64 	unsigned int convert_arg;
65 	unsigned int scan_end_src;
66 	unsigned int scan_end_arg;
67 	unsigned int stop_src;
68 	unsigned int stop_arg;
69 	compat_uptr_t chanlist;		/* 32-bit 'unsigned int *' */
70 	unsigned int chanlist_len;
71 	compat_uptr_t data;		/* 32-bit 'short *' */
72 	unsigned int data_len;
73 };
74 
75 struct comedi32_insn_struct {
76 	unsigned int insn;
77 	unsigned int n;
78 	compat_uptr_t data;		/* 32-bit 'unsigned int *' */
79 	unsigned int subdev;
80 	unsigned int chanspec;
81 	unsigned int unused[3];
82 };
83 
84 struct comedi32_insnlist_struct {
85 	unsigned int n_insns;
86 	compat_uptr_t insns;		/* 32-bit 'struct comedi_insn *' */
87 };
88 
89 /* Handle translated ioctl. */
translated_ioctl(struct file * file,unsigned int cmd,unsigned long arg)90 static int translated_ioctl(struct file *file, unsigned int cmd,
91 			    unsigned long arg)
92 {
93 	if (file->f_op->unlocked_ioctl)
94 		return file->f_op->unlocked_ioctl(file, cmd, arg);
95 
96 	return -ENOTTY;
97 }
98 
99 /* Handle 32-bit COMEDI_CHANINFO ioctl. */
compat_chaninfo(struct file * file,unsigned long arg)100 static int compat_chaninfo(struct file *file, unsigned long arg)
101 {
102 	struct comedi_chaninfo __user *chaninfo;
103 	struct comedi32_chaninfo_struct __user *chaninfo32;
104 	int err;
105 	union {
106 		unsigned int uint;
107 		compat_uptr_t uptr;
108 	} temp;
109 
110 	chaninfo32 = compat_ptr(arg);
111 	chaninfo = compat_alloc_user_space(sizeof(*chaninfo));
112 
113 	/* Copy chaninfo structure.  Ignore unused members. */
114 	if (!access_ok(VERIFY_READ, chaninfo32, sizeof(*chaninfo32)) ||
115 	    !access_ok(VERIFY_WRITE, chaninfo, sizeof(*chaninfo)))
116 		return -EFAULT;
117 
118 	err = 0;
119 	err |= __get_user(temp.uint, &chaninfo32->subdev);
120 	err |= __put_user(temp.uint, &chaninfo->subdev);
121 	err |= __get_user(temp.uptr, &chaninfo32->maxdata_list);
122 	err |= __put_user(compat_ptr(temp.uptr), &chaninfo->maxdata_list);
123 	err |= __get_user(temp.uptr, &chaninfo32->flaglist);
124 	err |= __put_user(compat_ptr(temp.uptr), &chaninfo->flaglist);
125 	err |= __get_user(temp.uptr, &chaninfo32->rangelist);
126 	err |= __put_user(compat_ptr(temp.uptr), &chaninfo->rangelist);
127 	if (err)
128 		return -EFAULT;
129 
130 	return translated_ioctl(file, COMEDI_CHANINFO, (unsigned long)chaninfo);
131 }
132 
133 /* Handle 32-bit COMEDI_RANGEINFO ioctl. */
compat_rangeinfo(struct file * file,unsigned long arg)134 static int compat_rangeinfo(struct file *file, unsigned long arg)
135 {
136 	struct comedi_rangeinfo __user *rangeinfo;
137 	struct comedi32_rangeinfo_struct __user *rangeinfo32;
138 	int err;
139 	union {
140 		unsigned int uint;
141 		compat_uptr_t uptr;
142 	} temp;
143 
144 	rangeinfo32 = compat_ptr(arg);
145 	rangeinfo = compat_alloc_user_space(sizeof(*rangeinfo));
146 
147 	/* Copy rangeinfo structure. */
148 	if (!access_ok(VERIFY_READ, rangeinfo32, sizeof(*rangeinfo32)) ||
149 	    !access_ok(VERIFY_WRITE, rangeinfo, sizeof(*rangeinfo)))
150 		return -EFAULT;
151 
152 	err = 0;
153 	err |= __get_user(temp.uint, &rangeinfo32->range_type);
154 	err |= __put_user(temp.uint, &rangeinfo->range_type);
155 	err |= __get_user(temp.uptr, &rangeinfo32->range_ptr);
156 	err |= __put_user(compat_ptr(temp.uptr), &rangeinfo->range_ptr);
157 	if (err)
158 		return -EFAULT;
159 
160 	return translated_ioctl(file, COMEDI_RANGEINFO,
161 				(unsigned long)rangeinfo);
162 }
163 
164 /* Copy 32-bit cmd structure to native cmd structure. */
get_compat_cmd(struct comedi_cmd __user * cmd,struct comedi32_cmd_struct __user * cmd32)165 static int get_compat_cmd(struct comedi_cmd __user *cmd,
166 			  struct comedi32_cmd_struct __user *cmd32)
167 {
168 	int err;
169 	union {
170 		unsigned int uint;
171 		compat_uptr_t uptr;
172 	} temp;
173 
174 	/* Copy cmd structure. */
175 	if (!access_ok(VERIFY_READ, cmd32, sizeof(*cmd32)) ||
176 	    !access_ok(VERIFY_WRITE, cmd, sizeof(*cmd)))
177 		return -EFAULT;
178 
179 	err = 0;
180 	err |= __get_user(temp.uint, &cmd32->subdev);
181 	err |= __put_user(temp.uint, &cmd->subdev);
182 	err |= __get_user(temp.uint, &cmd32->flags);
183 	err |= __put_user(temp.uint, &cmd->flags);
184 	err |= __get_user(temp.uint, &cmd32->start_src);
185 	err |= __put_user(temp.uint, &cmd->start_src);
186 	err |= __get_user(temp.uint, &cmd32->start_arg);
187 	err |= __put_user(temp.uint, &cmd->start_arg);
188 	err |= __get_user(temp.uint, &cmd32->scan_begin_src);
189 	err |= __put_user(temp.uint, &cmd->scan_begin_src);
190 	err |= __get_user(temp.uint, &cmd32->scan_begin_arg);
191 	err |= __put_user(temp.uint, &cmd->scan_begin_arg);
192 	err |= __get_user(temp.uint, &cmd32->convert_src);
193 	err |= __put_user(temp.uint, &cmd->convert_src);
194 	err |= __get_user(temp.uint, &cmd32->convert_arg);
195 	err |= __put_user(temp.uint, &cmd->convert_arg);
196 	err |= __get_user(temp.uint, &cmd32->scan_end_src);
197 	err |= __put_user(temp.uint, &cmd->scan_end_src);
198 	err |= __get_user(temp.uint, &cmd32->scan_end_arg);
199 	err |= __put_user(temp.uint, &cmd->scan_end_arg);
200 	err |= __get_user(temp.uint, &cmd32->stop_src);
201 	err |= __put_user(temp.uint, &cmd->stop_src);
202 	err |= __get_user(temp.uint, &cmd32->stop_arg);
203 	err |= __put_user(temp.uint, &cmd->stop_arg);
204 	err |= __get_user(temp.uptr, &cmd32->chanlist);
205 	err |= __put_user((unsigned int __force *)compat_ptr(temp.uptr),
206 			&cmd->chanlist);
207 	err |= __get_user(temp.uint, &cmd32->chanlist_len);
208 	err |= __put_user(temp.uint, &cmd->chanlist_len);
209 	err |= __get_user(temp.uptr, &cmd32->data);
210 	err |= __put_user(compat_ptr(temp.uptr), &cmd->data);
211 	err |= __get_user(temp.uint, &cmd32->data_len);
212 	err |= __put_user(temp.uint, &cmd->data_len);
213 	return err ? -EFAULT : 0;
214 }
215 
216 /* Copy native cmd structure to 32-bit cmd structure. */
put_compat_cmd(struct comedi32_cmd_struct __user * cmd32,struct comedi_cmd __user * cmd)217 static int put_compat_cmd(struct comedi32_cmd_struct __user *cmd32,
218 			  struct comedi_cmd __user *cmd)
219 {
220 	int err;
221 	unsigned int temp;
222 
223 	/*
224 	 * Copy back most of cmd structure.
225 	 *
226 	 * Assume the pointer values are already valid.
227 	 * (Could use ptr_to_compat() to set them.)
228 	 */
229 	if (!access_ok(VERIFY_READ, cmd, sizeof(*cmd)) ||
230 	    !access_ok(VERIFY_WRITE, cmd32, sizeof(*cmd32)))
231 		return -EFAULT;
232 
233 	err = 0;
234 	err |= __get_user(temp, &cmd->subdev);
235 	err |= __put_user(temp, &cmd32->subdev);
236 	err |= __get_user(temp, &cmd->flags);
237 	err |= __put_user(temp, &cmd32->flags);
238 	err |= __get_user(temp, &cmd->start_src);
239 	err |= __put_user(temp, &cmd32->start_src);
240 	err |= __get_user(temp, &cmd->start_arg);
241 	err |= __put_user(temp, &cmd32->start_arg);
242 	err |= __get_user(temp, &cmd->scan_begin_src);
243 	err |= __put_user(temp, &cmd32->scan_begin_src);
244 	err |= __get_user(temp, &cmd->scan_begin_arg);
245 	err |= __put_user(temp, &cmd32->scan_begin_arg);
246 	err |= __get_user(temp, &cmd->convert_src);
247 	err |= __put_user(temp, &cmd32->convert_src);
248 	err |= __get_user(temp, &cmd->convert_arg);
249 	err |= __put_user(temp, &cmd32->convert_arg);
250 	err |= __get_user(temp, &cmd->scan_end_src);
251 	err |= __put_user(temp, &cmd32->scan_end_src);
252 	err |= __get_user(temp, &cmd->scan_end_arg);
253 	err |= __put_user(temp, &cmd32->scan_end_arg);
254 	err |= __get_user(temp, &cmd->stop_src);
255 	err |= __put_user(temp, &cmd32->stop_src);
256 	err |= __get_user(temp, &cmd->stop_arg);
257 	err |= __put_user(temp, &cmd32->stop_arg);
258 	/* Assume chanlist pointer is unchanged. */
259 	err |= __get_user(temp, &cmd->chanlist_len);
260 	err |= __put_user(temp, &cmd32->chanlist_len);
261 	/* Assume data pointer is unchanged. */
262 	err |= __get_user(temp, &cmd->data_len);
263 	err |= __put_user(temp, &cmd32->data_len);
264 	return err ? -EFAULT : 0;
265 }
266 
267 /* Handle 32-bit COMEDI_CMD ioctl. */
compat_cmd(struct file * file,unsigned long arg)268 static int compat_cmd(struct file *file, unsigned long arg)
269 {
270 	struct comedi_cmd __user *cmd;
271 	struct comedi32_cmd_struct __user *cmd32;
272 	int rc, err;
273 
274 	cmd32 = compat_ptr(arg);
275 	cmd = compat_alloc_user_space(sizeof(*cmd));
276 
277 	rc = get_compat_cmd(cmd, cmd32);
278 	if (rc)
279 		return rc;
280 
281 	rc = translated_ioctl(file, COMEDI_CMD, (unsigned long)cmd);
282 	if (rc == -EAGAIN) {
283 		/* Special case: copy cmd back to user. */
284 		err = put_compat_cmd(cmd32, cmd);
285 		if (err)
286 			rc = err;
287 	}
288 
289 	return rc;
290 }
291 
292 /* Handle 32-bit COMEDI_CMDTEST ioctl. */
compat_cmdtest(struct file * file,unsigned long arg)293 static int compat_cmdtest(struct file *file, unsigned long arg)
294 {
295 	struct comedi_cmd __user *cmd;
296 	struct comedi32_cmd_struct __user *cmd32;
297 	int rc, err;
298 
299 	cmd32 = compat_ptr(arg);
300 	cmd = compat_alloc_user_space(sizeof(*cmd));
301 
302 	rc = get_compat_cmd(cmd, cmd32);
303 	if (rc)
304 		return rc;
305 
306 	rc = translated_ioctl(file, COMEDI_CMDTEST, (unsigned long)cmd);
307 	if (rc < 0)
308 		return rc;
309 
310 	err = put_compat_cmd(cmd32, cmd);
311 	if (err)
312 		rc = err;
313 
314 	return rc;
315 }
316 
317 /* Copy 32-bit insn structure to native insn structure. */
get_compat_insn(struct comedi_insn __user * insn,struct comedi32_insn_struct __user * insn32)318 static int get_compat_insn(struct comedi_insn __user *insn,
319 			   struct comedi32_insn_struct __user *insn32)
320 {
321 	int err;
322 	union {
323 		unsigned int uint;
324 		compat_uptr_t uptr;
325 	} temp;
326 
327 	/* Copy insn structure.  Ignore the unused members. */
328 	err = 0;
329 	if (!access_ok(VERIFY_READ, insn32, sizeof(*insn32)) ||
330 	    !access_ok(VERIFY_WRITE, insn, sizeof(*insn)))
331 		return -EFAULT;
332 
333 	err |= __get_user(temp.uint, &insn32->insn);
334 	err |= __put_user(temp.uint, &insn->insn);
335 	err |= __get_user(temp.uint, &insn32->n);
336 	err |= __put_user(temp.uint, &insn->n);
337 	err |= __get_user(temp.uptr, &insn32->data);
338 	err |= __put_user(compat_ptr(temp.uptr), &insn->data);
339 	err |= __get_user(temp.uint, &insn32->subdev);
340 	err |= __put_user(temp.uint, &insn->subdev);
341 	err |= __get_user(temp.uint, &insn32->chanspec);
342 	err |= __put_user(temp.uint, &insn->chanspec);
343 	return err ? -EFAULT : 0;
344 }
345 
346 /* Handle 32-bit COMEDI_INSNLIST ioctl. */
compat_insnlist(struct file * file,unsigned long arg)347 static int compat_insnlist(struct file *file, unsigned long arg)
348 {
349 	struct combined_insnlist {
350 		struct comedi_insnlist insnlist;
351 		struct comedi_insn insn[1];
352 	} __user *s;
353 	struct comedi32_insnlist_struct __user *insnlist32;
354 	struct comedi32_insn_struct __user *insn32;
355 	compat_uptr_t uptr;
356 	unsigned int n_insns, n;
357 	int err, rc;
358 
359 	insnlist32 = compat_ptr(arg);
360 
361 	/* Get 32-bit insnlist structure.  */
362 	if (!access_ok(VERIFY_READ, insnlist32, sizeof(*insnlist32)))
363 		return -EFAULT;
364 
365 	err = 0;
366 	err |= __get_user(n_insns, &insnlist32->n_insns);
367 	err |= __get_user(uptr, &insnlist32->insns);
368 	insn32 = compat_ptr(uptr);
369 	if (err)
370 		return -EFAULT;
371 
372 	/* Allocate user memory to copy insnlist and insns into. */
373 	s = compat_alloc_user_space(offsetof(struct combined_insnlist,
374 					     insn[n_insns]));
375 
376 	/* Set native insnlist structure. */
377 	if (!access_ok(VERIFY_WRITE, &s->insnlist, sizeof(s->insnlist)))
378 		return -EFAULT;
379 
380 	err |= __put_user(n_insns, &s->insnlist.n_insns);
381 	err |= __put_user(&s->insn[0], &s->insnlist.insns);
382 	if (err)
383 		return -EFAULT;
384 
385 	/* Copy insn structures. */
386 	for (n = 0; n < n_insns; n++) {
387 		rc = get_compat_insn(&s->insn[n], &insn32[n]);
388 		if (rc)
389 			return rc;
390 	}
391 
392 	return translated_ioctl(file, COMEDI_INSNLIST,
393 				(unsigned long)&s->insnlist);
394 }
395 
396 /* Handle 32-bit COMEDI_INSN ioctl. */
compat_insn(struct file * file,unsigned long arg)397 static int compat_insn(struct file *file, unsigned long arg)
398 {
399 	struct comedi_insn __user *insn;
400 	struct comedi32_insn_struct __user *insn32;
401 	int rc;
402 
403 	insn32 = compat_ptr(arg);
404 	insn = compat_alloc_user_space(sizeof(*insn));
405 
406 	rc = get_compat_insn(insn, insn32);
407 	if (rc)
408 		return rc;
409 
410 	return translated_ioctl(file, COMEDI_INSN, (unsigned long)insn);
411 }
412 
413 /*
414  * compat_ioctl file operation.
415  *
416  * Returns -ENOIOCTLCMD for unrecognised ioctl codes.
417  */
comedi_compat_ioctl(struct file * file,unsigned int cmd,unsigned long arg)418 long comedi_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
419 {
420 	int rc;
421 
422 	switch (cmd) {
423 	case COMEDI_DEVCONFIG:
424 	case COMEDI_DEVINFO:
425 	case COMEDI_SUBDINFO:
426 	case COMEDI_BUFCONFIG:
427 	case COMEDI_BUFINFO:
428 		/* Just need to translate the pointer argument. */
429 		arg = (unsigned long)compat_ptr(arg);
430 		rc = translated_ioctl(file, cmd, arg);
431 		break;
432 	case COMEDI_LOCK:
433 	case COMEDI_UNLOCK:
434 	case COMEDI_CANCEL:
435 	case COMEDI_POLL:
436 	case COMEDI_SETRSUBD:
437 	case COMEDI_SETWSUBD:
438 		/* No translation needed. */
439 		rc = translated_ioctl(file, cmd, arg);
440 		break;
441 	case COMEDI32_CHANINFO:
442 		rc = compat_chaninfo(file, arg);
443 		break;
444 	case COMEDI32_RANGEINFO:
445 		rc = compat_rangeinfo(file, arg);
446 		break;
447 	case COMEDI32_CMD:
448 		rc = compat_cmd(file, arg);
449 		break;
450 	case COMEDI32_CMDTEST:
451 		rc = compat_cmdtest(file, arg);
452 		break;
453 	case COMEDI32_INSNLIST:
454 		rc = compat_insnlist(file, arg);
455 		break;
456 	case COMEDI32_INSN:
457 		rc = compat_insn(file, arg);
458 		break;
459 	default:
460 		rc = -ENOIOCTLCMD;
461 		break;
462 	}
463 	return rc;
464 }
465