[NET_SCHED]: cls_basic: fix NULL pointer dereference
[linux-2.6/verdex.git] / arch / i386 / kernel / ldt.c
blobb410e5fb034f285346ef41c4cc6929db3081790b
1 /*
2 * linux/arch/i386/kernel/ldt.c
4 * Copyright (C) 1992 Krishna Balasubramanian and Linus Torvalds
5 * Copyright (C) 1999 Ingo Molnar <mingo@redhat.com>
6 */
8 #include <linux/errno.h>
9 #include <linux/sched.h>
10 #include <linux/string.h>
11 #include <linux/mm.h>
12 #include <linux/smp.h>
13 #include <linux/smp_lock.h>
14 #include <linux/vmalloc.h>
15 #include <linux/slab.h>
17 #include <asm/uaccess.h>
18 #include <asm/system.h>
19 #include <asm/ldt.h>
20 #include <asm/desc.h>
21 #include <asm/mmu_context.h>
23 #ifdef CONFIG_SMP /* avoids "defined but not used" warnig */
24 static void flush_ldt(void *null)
26 if (current->active_mm)
27 load_LDT(&current->active_mm->context);
29 #endif
31 static int alloc_ldt(mm_context_t *pc, int mincount, int reload)
33 void *oldldt;
34 void *newldt;
35 int oldsize;
37 if (mincount <= pc->size)
38 return 0;
39 oldsize = pc->size;
40 mincount = (mincount+511)&(~511);
41 if (mincount*LDT_ENTRY_SIZE > PAGE_SIZE)
42 newldt = vmalloc(mincount*LDT_ENTRY_SIZE);
43 else
44 newldt = kmalloc(mincount*LDT_ENTRY_SIZE, GFP_KERNEL);
46 if (!newldt)
47 return -ENOMEM;
49 if (oldsize)
50 memcpy(newldt, pc->ldt, oldsize*LDT_ENTRY_SIZE);
51 oldldt = pc->ldt;
52 memset(newldt+oldsize*LDT_ENTRY_SIZE, 0, (mincount-oldsize)*LDT_ENTRY_SIZE);
53 pc->ldt = newldt;
54 wmb();
55 pc->size = mincount;
56 wmb();
58 if (reload) {
59 #ifdef CONFIG_SMP
60 cpumask_t mask;
61 preempt_disable();
62 load_LDT(pc);
63 mask = cpumask_of_cpu(smp_processor_id());
64 if (!cpus_equal(current->mm->cpu_vm_mask, mask))
65 smp_call_function(flush_ldt, NULL, 1, 1);
66 preempt_enable();
67 #else
68 load_LDT(pc);
69 #endif
71 if (oldsize) {
72 if (oldsize*LDT_ENTRY_SIZE > PAGE_SIZE)
73 vfree(oldldt);
74 else
75 kfree(oldldt);
77 return 0;
80 static inline int copy_ldt(mm_context_t *new, mm_context_t *old)
82 int err = alloc_ldt(new, old->size, 0);
83 if (err < 0)
84 return err;
85 memcpy(new->ldt, old->ldt, old->size*LDT_ENTRY_SIZE);
86 return 0;
90 * we do not have to muck with descriptors here, that is
91 * done in switch_mm() as needed.
93 int init_new_context(struct task_struct *tsk, struct mm_struct *mm)
95 struct mm_struct * old_mm;
96 int retval = 0;
98 init_MUTEX(&mm->context.sem);
99 mm->context.size = 0;
100 old_mm = current->mm;
101 if (old_mm && old_mm->context.size > 0) {
102 down(&old_mm->context.sem);
103 retval = copy_ldt(&mm->context, &old_mm->context);
104 up(&old_mm->context.sem);
106 return retval;
110 * No need to lock the MM as we are the last user
112 void destroy_context(struct mm_struct *mm)
114 if (mm->context.size) {
115 if (mm == current->active_mm)
116 clear_LDT();
117 if (mm->context.size*LDT_ENTRY_SIZE > PAGE_SIZE)
118 vfree(mm->context.ldt);
119 else
120 kfree(mm->context.ldt);
121 mm->context.size = 0;
125 static int read_ldt(void __user * ptr, unsigned long bytecount)
127 int err;
128 unsigned long size;
129 struct mm_struct * mm = current->mm;
131 if (!mm->context.size)
132 return 0;
133 if (bytecount > LDT_ENTRY_SIZE*LDT_ENTRIES)
134 bytecount = LDT_ENTRY_SIZE*LDT_ENTRIES;
136 down(&mm->context.sem);
137 size = mm->context.size*LDT_ENTRY_SIZE;
138 if (size > bytecount)
139 size = bytecount;
141 err = 0;
142 if (copy_to_user(ptr, mm->context.ldt, size))
143 err = -EFAULT;
144 up(&mm->context.sem);
145 if (err < 0)
146 goto error_return;
147 if (size != bytecount) {
148 /* zero-fill the rest */
149 if (clear_user(ptr+size, bytecount-size) != 0) {
150 err = -EFAULT;
151 goto error_return;
154 return bytecount;
155 error_return:
156 return err;
159 static int read_default_ldt(void __user * ptr, unsigned long bytecount)
161 int err;
162 unsigned long size;
164 err = 0;
165 size = 5*sizeof(struct desc_struct);
166 if (size > bytecount)
167 size = bytecount;
169 err = size;
170 if (clear_user(ptr, size))
171 err = -EFAULT;
173 return err;
176 static int write_ldt(void __user * ptr, unsigned long bytecount, int oldmode)
178 struct mm_struct * mm = current->mm;
179 __u32 entry_1, entry_2;
180 int error;
181 struct user_desc ldt_info;
183 error = -EINVAL;
184 if (bytecount != sizeof(ldt_info))
185 goto out;
186 error = -EFAULT;
187 if (copy_from_user(&ldt_info, ptr, sizeof(ldt_info)))
188 goto out;
190 error = -EINVAL;
191 if (ldt_info.entry_number >= LDT_ENTRIES)
192 goto out;
193 if (ldt_info.contents == 3) {
194 if (oldmode)
195 goto out;
196 if (ldt_info.seg_not_present == 0)
197 goto out;
200 down(&mm->context.sem);
201 if (ldt_info.entry_number >= mm->context.size) {
202 error = alloc_ldt(&current->mm->context, ldt_info.entry_number+1, 1);
203 if (error < 0)
204 goto out_unlock;
207 /* Allow LDTs to be cleared by the user. */
208 if (ldt_info.base_addr == 0 && ldt_info.limit == 0) {
209 if (oldmode || LDT_empty(&ldt_info)) {
210 entry_1 = 0;
211 entry_2 = 0;
212 goto install;
216 entry_1 = LDT_entry_a(&ldt_info);
217 entry_2 = LDT_entry_b(&ldt_info);
218 if (oldmode)
219 entry_2 &= ~(1 << 20);
221 /* Install the new entry ... */
222 install:
223 write_ldt_entry(mm->context.ldt, ldt_info.entry_number, entry_1, entry_2);
224 error = 0;
226 out_unlock:
227 up(&mm->context.sem);
228 out:
229 return error;
232 asmlinkage int sys_modify_ldt(int func, void __user *ptr, unsigned long bytecount)
234 int ret = -ENOSYS;
236 switch (func) {
237 case 0:
238 ret = read_ldt(ptr, bytecount);
239 break;
240 case 1:
241 ret = write_ldt(ptr, bytecount, 1);
242 break;
243 case 2:
244 ret = read_default_ldt(ptr, bytecount);
245 break;
246 case 0x11:
247 ret = write_ldt(ptr, bytecount, 0);
248 break;
250 return ret;