break; case DS_GET_CARD_SERVICES_INFO: ret = pcmcia_get_card_services_info(&buf->servinfo); 
static int ds_ioctl(struct inode * inode, struct file * file,		    u_int cmd, u_long arg){    struct pcmcia_socket *s;    void __user *uarg = (char __user *)arg;    u_int size;    int ret, err;    ds_ioctl_arg_t *buf;    user_info_t *user;    ds_dbg(2, "ds_ioctl(socket %d, %#x, %#lx)\n", iminor(inode), cmd, arg);    user = file->private_data;    if (CHECK_USER(user))	return -EIO;    s = user->socket;    if (s->pcmcia_state.dead)        return -EIO;    size = (cmd & IOCSIZE_MASK) >> IOCSIZE_SHIFT;    if (size > sizeof(ds_ioctl_arg_t)) return -EINVAL;    /* Permission check */    if (!(cmd & IOC_OUT) && !capable(CAP_SYS_ADMIN))	return -EPERM;    if (cmd & IOC_IN) {	if (!access_ok(VERIFY_READ, uarg, size)) {	    ds_dbg(3, "ds_ioctl(): verify_read = %d\n", -EFAULT);	    return -EFAULT;	}    }    if (cmd & IOC_OUT) {	if (!access_ok(VERIFY_WRITE, uarg, size)) {	    ds_dbg(3, "ds_ioctl(): verify_write = %d\n", -EFAULT);	    return -EFAULT;	}    }    buf = kmalloc(sizeof(ds_ioctl_arg_t), GFP_KERNEL);    if (!buf)	return -ENOMEM;    err = ret = 0;    if (cmd & IOC_IN) __copy_from_user((char *)buf, uarg, size);    switch (cmd) {    case DS_ADJUST_RESOURCE_INFO:	ret = pcmcia_adjust_resource_info(&buf->adjust);	break;    case DS_GET_CARD_SERVICES_INFO:	ret = pcmcia_get_card_services_info(&buf->servinfo);	break;    case DS_GET_CONFIGURATION_INFO:	if (buf->config.Function &&	   (buf->config.Function >= s->functions))	    ret = CS_BAD_ARGS;	else	    ret = pccard_get_configuration_info(s,			buf->config.Function, &buf->config);	break;    case DS_GET_FIRST_TUPLE:	down(&s->skt_sem);	pcmcia_validate_mem(s);	up(&s->skt_sem);	ret = pccard_get_first_tuple(s, BIND_FN_ALL, &buf->tuple);	break;    case DS_GET_NEXT_TUPLE:	ret = pccard_get_next_tuple(s, BIND_FN_ALL, &buf->tuple);	break;    case DS_GET_TUPLE_DATA:	buf->tuple.TupleData = buf->tuple_parse.data;	buf->tuple.TupleDataMax = sizeof(buf->tuple_parse.data);	ret = pccard_get_tuple_data(s, &buf->tuple);	break;    case DS_PARSE_TUPLE:	buf->tuple.TupleData = buf->tuple_parse.data;	ret = pccard_parse_tuple(&buf->tuple, &buf->tuple_parse.parse);	break;    case DS_RESET_CARD:	ret = pccard_reset_card(s);	break;    case DS_GET_STATUS:	if (buf->status.Function &&	   (buf->status.Function >= s->functions))	    ret = CS_BAD_ARGS;	else	ret = pccard_get_status(s, buf->status.Function, &buf->status);	break;    case DS_VALIDATE_CIS:	down(&s->skt_sem);	pcmcia_validate_mem(s);	up(&s->skt_sem);	ret = pccard_validate_cis(s, BIND_FN_ALL, &buf->cisinfo);	break;    case DS_SUSPEND_CARD:	ret = pcmcia_suspend_card(s);	break;    case DS_RESUME_CARD:	ret = pcmcia_resume_card(s);	break;    case DS_EJECT_CARD:	err = pcmcia_eject_card(s);	break;    case DS_INSERT_CARD:	err = pcmcia_insert_card(s);	break;    case DS_ACCESS_CONFIGURATION_REGISTER:	if ((buf->conf_reg.Action == CS_WRITE) && !capable(CAP_SYS_ADMIN)) {	    err = -EPERM;	    goto free_out;	}	if (buf->conf_reg.Function &&	   (buf->conf_reg.Function >= s->functions))	    ret = CS_BAD_ARGS;	else	    ret = pccard_access_configuration_register(s,			buf->conf_reg.Function, &buf->conf_reg);	break;    case DS_GET_FIRST_REGION:    case DS_GET_NEXT_REGION:    case DS_BIND_MTD:	if (!capable(CAP_SYS_ADMIN)) {		err = -EPERM;		goto free_out;	} else {		static int printed = 0;		if (!printed) {			printk(KERN_WARNING "2.6. kernels use pcmciamtd instead of memory_cs.c and do not require special\n");			printk(KERN_WARNING "MTD handling any more.\n");			printed++;		}	}	err = -EINVAL;	goto free_out;	break;    case DS_GET_FIRST_WINDOW:	ret = pcmcia_get_window(s, &buf->win_info.handle, 0,			&buf->win_info.window);	break;    case DS_GET_NEXT_WINDOW:	ret = pcmcia_get_window(s, &buf->win_info.handle,			buf->win_info.handle->index + 1, &buf->win_info.window);	break;    case DS_GET_MEM_PAGE:	ret = pcmcia_get_mem_page(buf->win_info.handle,			   &buf->win_info.map);	break;    case DS_REPLACE_CIS:	ret = pcmcia_replace_cis(s, &buf->cisdump);	break;    case DS_BIND_REQUEST:	if (!capable(CAP_SYS_ADMIN)) {		err = -EPERM;		goto free_out;	}	err = bind_request(s, &buf->bind_info);	break;    case DS_GET_DEVICE_INFO:	err = get_device_info(s, &buf->bind_info, 1);	break;    case DS_GET_NEXT_DEVICE:	err = get_device_info(s, &buf->bind_info, 0);	break;    case DS_UNBIND_REQUEST:	err = 0;	break;    default:	err = -EINVAL;    }    if ((err == 0) && (ret != CS_SUCCESS)) {	ds_dbg(2, "ds_ioctl: ret = %d\n", ret);	switch (ret) {	case CS_BAD_SOCKET: case CS_NO_CARD:	    err = -ENODEV; break;	case CS_BAD_ARGS: case CS_BAD_ATTRIBUTE: case CS_BAD_IRQ:	case CS_BAD_TUPLE:	    err = -EINVAL; break;	case CS_IN_USE:	    err = -EBUSY; break;	case CS_OUT_OF_RESOURCE:	    err = -ENOSPC; break;	case CS_NO_MORE_ITEMS:	    err = -ENODATA; break;	case CS_UNSUPPORTED_FUNCTION:	    err = -ENOSYS; break;	default:	    err = -EIO; break;	}    }    if (cmd & IOC_OUT) {        if (__copy_to_user(uarg, (char *)buf, size))            err = -EFAULT;    }free_out:    kfree(buf);    return err;} /* ds_ioctl */
10457	/local/tlutelli/issta_data/temp/c/2005_temp/2005/10457/a00db1ba7c33619cbd7c3153e4746d15881c0383/pcmcia_ioctl.c/buggy/drivers/pcmcia/pcmcia_ioctl.c