Attachment #21767 for bug #56074

View | Details | Raw Unified | Return to bug 56074
Collapse All | Expand All




static ssize_t eeprom_read(struct file * file, char * buf, size_t count, loff_t *off)
{
  int i, read=0;
  unsigned long p = *off;

  unsigned char page;


    return -EFAULT;
  }

  if (count > eeprom.size - p)
  {
    /* truncate count */
    count = eeprom.size - p;

  
  if(read > 0)
  {
    *off = p + read;
  }

  eeprom.busy--;

  {
    restart = 0;
    written = 0;
    p = *off;
   
    
    while( (written < count) && (p < eeprom.size))


  eeprom.busy--;
  wake_up_interruptible(&eeprom.wait_q);
  if (written == 0 && p >= eeprom.size){
    return -ENOSPC;
  }
  *off = p;
  return written;
}





static ssize_t mtrr_read (struct file *file, char *buf, size_t len,
			  loff_t *ppos)
{
	loff_t pos = *ppos;
	if (pos < 0 || pos >= ascii_buf_bytes)
		return 0;
	if (len > ascii_buf_bytes - pos)
		len = ascii_buf_bytes - pos;
	if (copy_to_user(buf, ascii_buffer + pos, len))
		return -EFAULT;
	pos += len;
	*ppos = pos;
	return len;
}   /*  End Function mtrr_read  */

static ssize_t mtrr_write (struct file *file, const char *buf, size_t len,




efi_sys_table_read(struct file *file, char *buffer, size_t count, loff_t *ppos)
{
       void *data;
       loff_t pos = *ppos;
       
       ssize_t size;
       int max_nr_entries = 7; 	/* num ptrs to tables we could expose */

       if( efi.boot_info > 0 )
	       length += sprintf(proc_buffer+length, "BootInfo=0x%lx\n", __pa(efi.boot_info));

       if (pos != (unsigned)pos || pos >= length)
	       return 0;

       data = (u8 *) proc_buffer + pos;
       size = length - pos;
       if (size > count)
               size = count;
       if (copy_to_user(buffer, data, size))
               return -EFAULT;

       kfree(proc_buffer);
       *ppos = pos + size;
       return size;
}





	size_t size;
	u8 *buf;
	u64 bufsize;
	loff_t pos = *ppos;

	if (data->state == STATE_LOG_RECORD) {
		buf = data->log_buffer;

		buf = NULL;
		bufsize = 0;
	}
	if (pos != (unsigned)pos || pos >= bufsize)
		return 0;

	saldata = buf + pos;
	size = bufsize - pos;
	if (size > count)
		size = count;
	if (copy_to_user(buffer, saldata, size))
		return -EFAULT;

	*ppos = pos + size;
	return size;
}


Lines 284-290 Link Here

(-)linux-2.4.21/arch/mips/sibyte/sb1250/bcm1250_tbprof.c (-1 / +3 lines)
284	char *dest = buf;	284	char *dest = buf;
285	long cur_off = *offp;	285	long cur_off = *offp;
286		286
287	count = 0;	287	if (cur_off < 0)
		288	return -EINVAL;
		289
288	cur_sample = cur_off / TB_SAMPLE_SIZE;	290	cur_sample = cur_off / TB_SAMPLE_SIZE;
289	sample_off = cur_off % TB_SAMPLE_SIZE;	291	sample_off = cur_off % TB_SAMPLE_SIZE;
290	sample_left = TB_SAMPLE_SIZE - sample_off;	292	sample_left = TB_SAMPLE_SIZE - sample_off;




			     size_t count, loff_t *ppos)
{
	unsigned long mmcr0 = 0, pmc1 = 0, pmc2 = 0;
	loff_t pos = *ppos;
	int n = 0;
#ifdef CONFIG_PPC_STD_MMU
	int valid;

		      "Non-error misses: %lu\n"
		      "Error misses\t: %lu\n",
		      pte_misses, pte_errors);
	if (pos != (unsigned)pos || pos >= strlen(buffer))
		return 0;
	if (n > strlen(buffer) - pos)
		n = strlen(buffer) - pos;
	if (n > count)
		n = count;
	copy_to_user(buf, buffer + pos, n);
	*ppos = pos + n;
	return n;
}





		size_t count, loff_t *ppos)
{
	int n;
	loff_t pos = *ppos;
	if (power_on_time == 0)
		n = sprintf(buf, "Power on time not set\n");
	else
		n = sprintf(buf, "%lu\n", power_on_time);

	if (pos != (unsigned)pos || pos >= strlen(buf))
		return 0;
	if (n > strlen(buf) - pos)
		n = strlen(buf) - pos;
	if (n > count)
		n = count;
	*ppos = pos + n;
	return n;
}


		size_t count, loff_t *ppos)
{
	int n = 0;
	loff_t pos = *ppos;
	if (progress_led != NULL)
		n = sprintf (buf, "%s\n", progress_led);
	if (pos != (unsigned)pos || pos >= strlen(buf))
		return 0;
	if (n > strlen(buf) - pos)
		n = strlen(buf) - pos;
	if (n > count)
		n = count;
	*ppos = pos + n;
	return n;
}


{
	unsigned int year, mon, day, hour, min, sec;
	unsigned long *ret = kmalloc(4*8, GFP_KERNEL);
	loff_t pos = *ppos;
	int n, error;

	error = call_rtas("get-time-of-day", 0, 8, ret);

	}
	kfree(ret);

	if (pos != (unsigned)pos || pos >= strlen(buf))
		return 0;
	if (n > strlen(buf) - pos)
		n = strlen(buf) - pos;
	if (n > count)
		n = count;
	*ppos = pos + n;
	return n;
}


static ssize_t ppc_rtas_tone_freq_read(struct file * file, char * buf,
		size_t count, loff_t *ppos)
{
	int n = sprintf(buf, "%lu\n", rtas_tone_frequency);
	loff_t pos = *ppos;

	if (pos != (unsigned)pos || pos >= strlen(buf))
		return 0;
	if (n > strlen(buf) - pos)
		n = strlen(buf) - pos;
	if (n > count)
		n = count;
	*ppos = pos + n;
	return n;
}
/* ****************************************************************** */

static ssize_t ppc_rtas_tone_volume_read(struct file * file, char * buf,
		size_t count, loff_t *ppos)
{
	int n = sprintf(buf, "%lu\n", rtas_tone_volume);
	loff_t pos = *ppos;

	if (pos != (unsigned)pos || pos >= strlen(buf))
		return 0;
	if (n > strlen(buf) - pos)
		n = strlen(buf) - pos;
	if (n > count)
		n = count;
	*ppos = pos + n;

	return n;
}

Lines 329-335 Link Here

(-)linux-2.4.21/arch/ppc64/kernel/lparcfg.c (-1 / +1 lines)
329	ret = -EFAULT;	329	ret = -EFAULT;
330	else {	330	else {
331	ret = count;	331	ret = count;
332	*ppos += count;	332	*ppos = p + count;
333	}	333	}
334	up(&lparcfg_sem);	334	up(&lparcfg_sem);
335	return ret;	335	return ret;




{
	ssize_t len;
	char *tmp_buffer;
	loff_t pos = *ppos;

	if (verify_area(VERIFY_WRITE, buf, count))
		return -EFAULT;
	if ((unsigned)pos != pos || pos >= rtas_nvram_size)
		return 0;
	if (count > rtas_nvram_size) 
		count = rtas_nvram_size;

		return -ENOMEM;
	}

	len = read_nvram(tmp_buffer, count, &pos);
	if (len <= 0) {
		kfree(tmp_buffer);
		return len;

	}

	kfree(tmp_buffer);
	*ppos = pos;
	return len;

}

{
	ssize_t len;
	char * tmp_buffer;
	loff_t pos = *ppos;

	if (verify_area(VERIFY_READ, buf, count))
		return -EFAULT;
	if (pos != (unsigned) pos || pos >= rtas_nvram_size)
		return 0;
	if (count > rtas_nvram_size)
		count = rtas_nvram_size;

		return -EFAULT;
	}

	len = write_nvram(tmp_buffer, count, &pos);
	*ppos = pos;

	kfree(tmp_buffer);
	return len;




	}
	pnt = (char *)(perfmon_base.profile_buffer) + p - sizeof(unsigned int);
	copy_to_user(buf,(void *)pnt,count);
	p += count;
	read += count;
	*ppos = p;
	return read;
}


			    size_t count, loff_t *ppos)
{
	unsigned long p = *ppos;
	ssize_t read;
	char * pnt;

	if (p >= (perfmon_base.trace_length)) return 0;
	if (count > (perfmon_base.trace_length) - p)
		count = (perfmon_base.trace_length) - p;
	read = 0;

	pnt = (char *)(perfmon_base.trace_buffer) + p;
	copy_to_user(buf,(void *)pnt,count);
	p += count;
	*ppos = p;
	return count;
}

static ssize_t write_trace(struct file * file, const char * buf,

	if (p >= (perfmon_base.timeslice_length)) return 0;
	if (count > (perfmon_base.timeslice_length) - p)
		count = (perfmon_base.timeslice_length) - p;
	read = 0;

	pnt = (char *)(perfmon_base.timeslice_buffer) + p;
	copy_to_user(buf,(void *)pnt,count);
	*ppos = p + count;
	return count;
	return read;
}

static ssize_t write_timeslice(struct file * file, const char * buf,




	struct proc_dir_entry *dp = file->f_dentry->d_inode->u.generic_ip;
	struct rtas_update_flash_t *uf;
	char msg[RTAS_MSG_MAXLEN];
	loff_t pos = *ppos;
	int msglen;
	ssize_t ret;


		msglen = sprintf(msg, "%d\n", uf->status);
	}
	
	if (pos != (unsigned)pos || pos >= msglen) {
		ret =  0;
		goto done;
	}
	msglen -= pos;
	if (msglen > count)
		msglen = count;

	if (copy_to_user(buf, msg + pos, msglen)) {
		ret = -EFAULT;
		goto done;
	}
	*ppos = pos + msglen;
	ret = msglen;
done:
	up(&rtas_flash_sem);

	char msg[RTAS_MSG_MAXLEN];
	int msglen;
	ssize_t ret;
	loff_t pos = *ppos;

	if (down_interruptible(&rtas_flash_sem))
		return -ERESTARTSYS;

	}

	msglen = sprintf(msg, "%d\n", args_buf->status);
	if (pos != (unsigned)pos || pos >= msglen) {
		ret = 0;
		goto done;
	}
	
	msglen -= pos;
	if (msglen > count)
		msglen = count;

	if (copy_to_user(buf, msg + pos, msglen)) {
		ret = -EFAULT;
		goto done;
	}
	*ppos = pos + msglen;
	ret = msglen;

done:

{
	struct proc_dir_entry *dp = file->f_dentry->d_inode->u.generic_ip;
	struct rtas_validate_flash_t *args_buf;
	loff_t pos = *off;
	ssize_t ret;

	if (down_interruptible(&rtas_flash_sem))


	/* We are only interested in the first 4K of the
	 * candidate image */
	if (pos != (unsigned)pos || pos >= VALIDATE_BUF_SIZE || 
		(args_buf->status == VALIDATE_AUTH)) {
		*off = pos + count;
		ret = count;
		goto done;
	}

	if (count >= VALIDATE_BUF_SIZE - pos)  {
		count = VALIDATE_BUF_SIZE - pos;
		args_buf->status = VALIDATE_READY;	
	} else {
		args_buf->status = VALIDATE_INCOMPLETE;
	}

	if (copy_from_user(args_buf->buf + pos, buf, count))  {
		ret = -EFAULT;
		goto done;
	}
	*off = pos + count;
	ret = count;

done:




		size_t count, loff_t *ppos)
{
	char timebuf[40];  
	loff_t pos = *ppos;
	int n;

	if (power_on_time == 0)

	else
		n = snprintf(timebuf, 40, "%lu\n", power_on_time);

	if (pos != (unsigned)pos || pos >= n)
		return 0;
	n++;		/* Include the null terminator */
	n -= pos;
		n -= *ppos;
	if (n > count)
		n = count;
	if (copy_to_user (buf, timebuf + pos, n)) {
		return -EFAULT;
	}
	*ppos = pos + n;
	return n;
}


{
	int n;
	char * tmpbuf;
	loff_t pos = *ppos;

	tmpbuf = kmalloc (MAX_LINELENGTH, GFP_KERNEL);
	if (!tmpbuf) {

	n = snprintf (tmpbuf, MAX_LINELENGTH, "%s\n", progress_led);
	if (n > MAX_LINELENGTH) n = MAX_LINELENGTH;

	if (pos != (unsigned)pos || pos >= n) {
		kfree (tmpbuf);
		return 0;
	}
	n++;		/* Include the null terminator */
	n -= pos;
		n -= *ppos;
	if (n > count)
		n = count;
	if (copy_to_user (buf, tmpbuf + pos, n)) {
		kfree (tmpbuf);
		return -EFAULT;
	}
	kfree (tmpbuf);
	*ppos = pos + n;
	return n;
}


	unsigned long tod[8];
	int n, error;
	char timebuf[30];  
	loff_t pos = *ppos;

	error = rtas_call(rtas_token("get-time-of-day"), 0, 8, tod);
	

				mktime(year, mon, day, hour, min, sec));
	}

	if (pos != (unsigned)pos || pos >= n)
		return 0;
	n++;		/* Include the null terminator */
	n -= pos;
		n -= *ppos;
	if (n > count)
		n = count;
	if (copy_to_user (buf, timebuf + pos, n)) {
		return -EFAULT;
	}
	*ppos = pos + n;
	return n;
}


{
	int n;
	char freqbuf[30];  
	loff_t pos = *ppos;

	n = snprintf(freqbuf, 30, "%lu\n", rtas_tone_frequency);
	if (pos != (unsigned)pos || pos >= n)
		return 0;
	n++;		/* Include the null terminator */
	n -= pos;
		n -= *ppos;
	if (n > count)
		n = count;
	if (copy_to_user (buf, freqbuf + pos, n)) {
		return -EFAULT;
	}
	*ppos = pos + n;
	return n;
}
/* ****************************************************************** */

{
	int n;
	char volbuf[10];  
	loff_t pos = *ppos;

	n = snprintf(volbuf, 10, "%lu\n", rtas_tone_volume);
	if (pos != (unsigned)pos || pos >= n)
		return 0;
	n++;		/* Include the null terminator */
	n -= pos;
		n -= *ppos;
	if (n > count)
		n = count;
	if (copy_to_user (buf, volbuf + pos, n)) {
		return -EFAULT;
	}
	*ppos = pos + n;
	return n;
}


	int i;
	int n = 0, cnt;
	int m = MAX_ERRINJCT_TOKENS * (ERRINJCT_TOKEN_LEN+1);
	loff_t pos = *ppos;

	buffer = (char *)kmalloc(m, GFP_KERNEL);
	if (!buffer) {

		n += cnt;
	}

	if (pos != (unsigned)pos || pos >= n) {
		kfree(buffer);
		return 0;
	}
	n++;		/* Include the null terminator */
	n -= pos;
		n -= *ppos;
	if (n > count)
		n = count;
	if (copy_to_user(buf, buffer + pos, n)) {
		kfree (buffer);
		return -EFAULT;
	}

	*ppos = pos + n;

	kfree(buffer);
	return n;

				    size_t count, loff_t *ppos)
{
	char kbuf[RMO_READ_BUF_MAX];
	loff_t pos = *ppos;
	int n;

	n = sprintf(kbuf, "%016lx %x\n", rtas_rmo_buf, RTAS_RMOBUF_MAX);

	if (pos != (unsigned)pos || pos >= n)
		return 0;
	n -= pos;
	if (n > count)
		n = count;
	if (copy_to_user(buf, kbuf + pos, n))
		return -EFAULT;
	*ppos = pos + n;
 	return n;
}




				goto out;
	}
out:
	p_info->offset           += count;
	p_info->act_entry_offset = size;	
	*offset = p_info->offset;
	return count;

		       input_buf[0]);
	}
      out:
	*offset = in_buf_size;
	return rc;		/* number of input characters */
}


        printk(KERN_INFO "debug: area `%c` is not valid\n", input_buf[0]);

      out:
        *offset = in_buf_size;
        return rc;              /* number of input characters */
}





				goto out;
	}
out:
	p_info->offset           += count;
	p_info->act_entry_offset = size;	
	*offset = p_info->offset;
	return count;

		       input_buf[0]);
	}
      out:
	*offset = in_buf_size;
	return rc;		/* number of input characters */
}


        printk(KERN_INFO "debug: area `%c` is not valid\n", input_buf[0]);

      out:
        *offset = in_buf_size;
        return rc;              /* number of input characters */
}





static ssize_t mtrr_read (struct file *file, char *buf, size_t len,
		loff_t * ppos)
{
	loff_t n = *ppos;
	unsigned pos = n;

	if (pos != n || pos >= ascii_buf_bytes)
		return 0;

	if (len > ascii_buf_bytes - pos)
		len = ascii_buf_bytes - pos;

	if (copy_to_user (buf, ascii_buffer + pos, len))
		return -EFAULT;

	*ppos = pos + len;
	return len;
}


Lines 520-525 Link Here

(-)linux-2.4.21/drivers/acpi/system.c (-8 / +19 lines)
520	struct acpi_buffer dsdt = {ACPI_ALLOCATE_BUFFER, NULL};	520	struct acpi_buffer dsdt = {ACPI_ALLOCATE_BUFFER, NULL};
521	void *data = 0;	521	void *data = 0;
522	size_t size = 0;	522	size_t size = 0;
		523	loff_t pos = *ppos;
523		524
524	ACPI_FUNCTION_TRACE("acpi_system_read_dsdt");	525	ACPI_FUNCTION_TRACE("acpi_system_read_dsdt");
525		526
Lines 527-535 Link Here
527	if (ACPI_FAILURE(status))	528	if (ACPI_FAILURE(status))
528	return_VALUE(-ENODEV);	529	return_VALUE(-ENODEV);
529		530
530	if (*ppos < dsdt.length) {	531	if (pos < 0)
531	data = dsdt.pointer + file->f_pos;	532	return -EINVAL;
532	size = dsdt.length - file->f_pos;	533
		534	if (pos < dsdt.length) {
		535	data = dsdt.pointer + pos;
		536	size = dsdt.length - pos;
533	if (size > count)	537	if (size > count)
534	size = count;	538	size = count;
535	if (copy_to_user(buffer, data, size)) {	539	if (copy_to_user(buffer, data, size)) {
Lines 540-546 Link Here
540		544
541	acpi_os_free(dsdt.pointer);	545	acpi_os_free(dsdt.pointer);
542		546
543	*ppos += size;	547	pos += size;
		548
		549	*ppos = pos;
544		550
545	return_VALUE(size);	551	return_VALUE(size);
546	}	552	}
Lines 563-568 Link Here
563	struct acpi_buffer fadt = {ACPI_ALLOCATE_BUFFER, NULL};	569	struct acpi_buffer fadt = {ACPI_ALLOCATE_BUFFER, NULL};
564	void *data = 0;	570	void *data = 0;
565	size_t size = 0;	571	size_t size = 0;
		572	loff_t pos = *ppos;
566		573
567	ACPI_FUNCTION_TRACE("acpi_system_read_fadt");	574	ACPI_FUNCTION_TRACE("acpi_system_read_fadt");
568		575
Lines 570-578 Link Here
570	if (ACPI_FAILURE(status))	577	if (ACPI_FAILURE(status))
571	return_VALUE(-ENODEV);	578	return_VALUE(-ENODEV);
572		579
573	if (*ppos < fadt.length) {	580	if (pos < 0)
574	data = fadt.pointer + file->f_pos;	581	return -EINVAL;
575	size = fadt.length - file->f_pos;	582
		583	if (pos < fadt.length) {
		584	data = fadt.pointer + pos;
		585	size = fadt.length - pos;
576	if (size > count)	586	if (size > count)
577	size = count;	587	size = count;
578	if (copy_to_user(buffer, data, size)) {	588	if (copy_to_user(buffer, data, size)) {
Lines 583-589 Link Here
583		593
584	acpi_os_free(fadt.pointer);	594	acpi_os_free(fadt.pointer);
585		595
586	*ppos += size;	596	pos += size;
		597	*ppos = pos;
587		598
588	return_VALUE(size);	599	return_VALUE(size);
589	}	600	}





{
	struct inode *node = file->f_dentry->d_inode;
	loff_t pos = *ppos;
	unsigned long page;
	int length;
	int end;

		count = length;
		goto out;
	}
	if (pos != (unsigned)pos || pos >= length) {
		count = 0;
		goto out;
	}
	if (count > length - pos)
		count = length - pos;
	end = count + pos;
	if (copy_to_user(buf, (char *)page + pos, count)) {
		count = -EFAULT;
		goto out;
	}
	*ppos = end;
out:	free_page( page );
	return( count );
}

Lines 320-333 Link Here

(-)linux-2.4.21/drivers/block/rd.c (-4 / +9 lines)
320	static ssize_t initrd_read(struct file file, char buf,	320	static ssize_t initrd_read(struct file file, char buf,
321	size_t count, loff_t *ppos)	321	size_t count, loff_t *ppos)
322	{	322	{
323	int left;	323	loff_t n = *ppos;
		324	unsigned pos = n;
		325	unsigned left = initrd_end - initrd_start;
324		326
325	left = initrd_end - initrd_start - *ppos;	327	if (pos != n \|\| pos >= left)
		328	return 0;
		329
		330	left -= pos;
326	if (count > left) count = left;	331	if (count > left) count = left;
327	if (count == 0) return 0;	332	if (count == 0) return 0;
328	if (copy_to_user(buf, (char )initrd_start + ppos, count))	333	if (copy_to_user(buf, (char *)initrd_start + pos, count))
329	return -EFAULT;	334	return -EFAULT;
330	*ppos += count;	335	*ppos = pos + count;
331	return count;	336	return count;
332	}	337	}
333		338





static ssize_t i8k_read(struct file *f, char *buffer, size_t len, loff_t *fpos)
{
    loff_t pos = *fpos;
    int n;
    char info[128];


	return n;
    }

    if (pos != (unsigned)pos || pos >= n) {
	return 0;
    }

    if (len >= n - pos) {
	len = n - pos;
    }

    if (copy_to_user(buffer, info, len) != 0) {
	return -EFAULT;
    }

    *fpos = pos + len;
    return len;
}





	void		*memptr;
	stlibrd_t	*brdp;
	int		brdnr, size, n;
	loff_t		pos = *offp;

#if DEBUG
	printk(KERN_DEBUG "stli_memread(fp=%x,buf=%x,count=%x,offp=%x)\n",

		return(-ENODEV);
	if (brdp->state == 0)
		return(-ENODEV);
	if (pos != (unsigned)pos || pos >= brdp->memsize)
		return(0);

	size = MIN(count, (brdp->memsize - pos));

	save_flags(flags);
	cli();
	EBRDENABLE(brdp);
	while (size > 0) {
		memptr = (void *) EBRDGETMEMPTR(brdp, pos);
		n = MIN(size, (brdp->pagesize - (((unsigned long) pos) % brdp->pagesize)));
		if (copy_to_user(buf, memptr, n)) {
			count = -EFAULT;
			goto out;
		}
		pos += n;
		buf += n;
		size -= n;
	}
	*offp = pos;
out:
	EBRDDISABLE(brdp);
	restore_flags(flags);

	stlibrd_t	*brdp;
	char		*chbuf;
	int		brdnr, size, n;
	loff_t		pos = *offp;

#if DEBUG
	printk(KERN_DEBUG "stli_memwrite(fp=%x,buf=%x,count=%x,offp=%x)\n",

		return(-ENODEV);
	if (brdp->state == 0)
		return(-ENODEV);
	if (pos != (unsigned)pos || pos >= brdp->memsize)
		return(0);

	chbuf = (char *) buf;
	size = MIN(count, (brdp->memsize - pos));

	save_flags(flags);
	cli();
	EBRDENABLE(brdp);
	while (size > 0) {
		memptr = (void *) EBRDGETMEMPTR(brdp, pos);
		n = MIN(size, (brdp->pagesize - (((unsigned long) pos) % brdp->pagesize)));
		if (copy_from_user(memptr, chbuf, n)) {
			count = -EFAULT;
			goto out;
		}
		pos += n;
		chbuf += n;
		size -= n;
	}
	*offp = pos;
out:
	EBRDDISABLE(brdp);
	restore_flags(flags);

Lines 66-72 Link Here

(-)linux-2.4.21/drivers/char/mem.c (-2 / +2 lines)
66	if (copy_from_user(p, buf, count))	66	if (copy_from_user(p, buf, count))
67	return -EFAULT;	67	return -EFAULT;
68	written += count;	68	written += count;
69	*ppos += written;	69	*ppos = realp + written;
70	return written;	70	return written;
71	}	71	}
72		72
Lines 107-113 Link Here
107	if (copy_to_user(buf, __va(p), count))	107	if (copy_to_user(buf, __va(p), count))
108	return -EFAULT;	108	return -EFAULT;
109	read += count;	109	read += count;
110	*ppos += read;	110	*ppos = p + read;
111	return read;	111	return read;
112	}	112	}
113		113

Lines 252-260 Link Here

(-)linux-2.4.21/drivers/char/nvram.c (-2 / +10 lines)
252	nvram_read(struct file file, char buf, size_t count, loff_t *ppos)	252	nvram_read(struct file file, char buf, size_t count, loff_t *ppos)
253	{	253	{
254	unsigned char contents[NVRAM_BYTES];	254	unsigned char contents[NVRAM_BYTES];
255	unsigned i = *ppos;	255	loff_t n = *ppos;
		256	unsigned i = n;
256	unsigned char *tmp;	257	unsigned char *tmp;
257		258
		259	if (i != n \|\| i >= NVRAM_BYTES)
		260	return 0;
		261
258	spin_lock_irq(&rtc_lock);	262	spin_lock_irq(&rtc_lock);
259		263
260	if (!__nvram_check_checksum())	264	if (!__nvram_check_checksum())
Lines 281-290 Link Here
281	nvram_write(struct file file, const char buf, size_t count, loff_t *ppos)	285	nvram_write(struct file file, const char buf, size_t count, loff_t *ppos)
282	{	286	{
283	unsigned char contents[NVRAM_BYTES];	287	unsigned char contents[NVRAM_BYTES];
284	unsigned i = *ppos;	288	loff_t n = *ppos;
		289	unsigned i = n;
285	unsigned char *tmp;	290	unsigned char *tmp;
286	int len;	291	int len;
287		292
		293	if (i != n \|\| i >= NVRAM_BYTES)
		294	return 0;
		295
288	len = (NVRAM_BYTES - i) < count ? (NVRAM_BYTES - i) : count;	296	len = (NVRAM_BYTES - i) < count ? (NVRAM_BYTES - i) : count;
289	if (copy_from_user(contents, buf, len))	297	if (copy_from_user(contents, buf, len))
290	return -EFAULT;	298	return -EFAULT;





static ssize_t flash_read(struct file *file, char *buf, size_t size, loff_t * ppos)
{
	loff_t n = *ppos;
	unsigned long p = n;
	unsigned int count = size;
	int ret = 0;


	if (count)
		ret = -ENXIO;

	if (n == p && p < gbFlashSize) {
		if (count > gbFlashSize - p)
			count = gbFlashSize - p;


			return -ERESTARTSYS;

		ret = count - copy_to_user(buf, (void *)(FLASH_BASE + p), count);
		*ppos = p + ret;
		up(&nwflash_sem);
		if (ret == 0)
			ret = -EFAULT;


static ssize_t flash_write(struct file *file, const char *buf, size_t size, loff_t * ppos)
{
	loff_t n = *ppos;
	unsigned long p = n;
	unsigned int count = size;
	int written;
	int nBlock, temp, rc;

	/*
	 * check for out of range pos or count
	 */
	if (p != n || p >= gbFlashSize)
		return count ? -ENXIO : 0;

	if (count > gbFlashSize - p)

		p += rc;
		buf += rc;
		written += rc;
		*ppos = p;

		if (flashdebug)
			printk(KERN_DEBUG "flash_write: written 0x%X bytes OK.\n", written);

Lines 309-314 Link Here

(-)linux-2.4.21/drivers/char/raw.c (-8 / +16 lines)
309	int minor;	309	int minor;
310	kdev_t dev;	310	kdev_t dev;
311	unsigned long limit;	311	unsigned long limit;
		312	loff_t off = *offp;
312		313
313	int sector_size, sector_bits, sector_mask;	314	int sector_size, sector_bits, sector_mask;
314	int max_sectors;	315	int max_sectors;
Lines 319-324 Link Here
319		320
320	minor = MINOR(filp->f_dentry->d_inode->i_rdev);	321	minor = MINOR(filp->f_dentry->d_inode->i_rdev);
321		322
		323	if (off < 0)
		324	return -EINVAL;
		325
322	err = alloc_kiovec(1, &iobuf);	326	err = alloc_kiovec(1, &iobuf);
323	if (err)	327	if (err)
324	return err;	328	return err;
Lines 338-349 Link Here
338	MAJOR(dev), MINOR(dev), limit);	342	MAJOR(dev), MINOR(dev), limit);
339		343
340	err = -EINVAL;	344	err = -EINVAL;
341	if ((*offp & sector_mask) \|\| (size & sector_mask))	345	if ((off & sector_mask) \|\| (size & sector_mask))
342	goto out_free;	346	goto out_free;
343	err = 0;	347	err = 0;
344	if (size)	348	if (size)
345	err = -ENXIO;	349	err = -ENXIO;
346	if ((*offp >> sector_bits) >= limit)	350	if ((off >> sector_bits) >= limit)
347	goto out_free;	351	goto out_free;
348		352
349	/*	353	/*
Lines 353-359 Link Here
353	*/	357	*/
354		358
355	transferred = 0;	359	transferred = 0;
356	blocknr = *offp >> sector_bits;	360	blocknr = off >> sector_bits;
357	while (size > 0) {	361	while (size > 0) {
358	blocks = size >> sector_bits;	362	blocks = size >> sector_bits;
359	if (blocks > max_sectors)	363	if (blocks > max_sectors)
Lines 390-396 Link Here
390	}	394	}
391		395
392	if (transferred) {	396	if (transferred) {
393	*offp += transferred;	397	*offp = off + transferred;
394	err = transferred;	398	err = transferred;
395	}	399	}
396		400
Lines 511-516 Link Here
511	int i, minor, err;	515	int i, minor, err;
512	int sector_size, sector_bits, sector_mask, max_sectors;	516	int sector_size, sector_bits, sector_mask, max_sectors;
513	ssize_t tot_len;	517	ssize_t tot_len;
		518	loff_t off = *offp;
		519
		520	if (off < 0)
		521	return -EINVAL;
514		522
515	for (i = 0, tot_len = 0; i < iov_count; i++) {	523	for (i = 0, tot_len = 0; i < iov_count; i++) {
516	ssize_t tmp = tot_len;	524	ssize_t tmp = tot_len;
Lines 547-561 Link Here
547	MAJOR(dev), MINOR(dev), limit);	555	MAJOR(dev), MINOR(dev), limit);
548		556
549	err = -EINVAL;	557	err = -EINVAL;
550	if ((*offp & sector_mask) \|\| (tot_len & sector_mask))	558	if ((off & sector_mask) \|\| (tot_len & sector_mask))
551	goto out;	559	goto out;
552	err = 0;	560	err = 0;
553	if (tot_len)	561	if (tot_len)
554	err = -ENXIO;	562	err = -ENXIO;
555	if ((*offp >> sector_bits) >= limit)	563	if ((off >> sector_bits) >= limit)
556	goto out;	564	goto out;
557		565
558	blocknr = *offp >> sector_bits;	566	blocknr = off >> sector_bits;
559	blocks = tot_len >> sector_bits;	567	blocks = tot_len >> sector_bits;
560		568
561	if (!blocks)	569	if (!blocks)
Lines 582-588 Link Here
582	unmap_kiobuf(iobuf);	590	unmap_kiobuf(iobuf);
583		591
584	if (err > 0)	592	if (err > 0)
585	*offp += err;	593	*offp = off + err;
586	out:	594	out:
587	free_kiovec(1, &iobuf);	595	free_kiovec(1, &iobuf);
588	return err;	596	return err;




{
	struct inode *inode = file->f_dentry->d_inode;
	unsigned int currcons = MINOR(inode->i_rdev);
	loff_t n = *ppos;
	unsigned pos = n;
	long viewed, attr, read;
	int col, maxcol;
	unsigned short *org = NULL;

	if (!vc_cons_allocated(currcons))
		goto unlock_out;

	ret = -EINVAL;
	if (pos < 0)
		goto unlock_out;
	read = 0;
	ret = 0;
	if (pos != n)
		goto unlock_out;
	while (count) {
		char *con_buf0, *con_buf_start;
		long this_round, size;

		acquire_console_sem();

		if (ret) {
			read += (orig_count - ret);
			ret = -EFAULT;
			goto unlock_out;
		}
		buf += orig_count;
		pos += orig_count;
		read += orig_count;
		count -= orig_count;
	}
	*ppos = pos;
	if (read)
		ret = read;
unlock_out:

{
	struct inode *inode = file->f_dentry->d_inode;
	unsigned int currcons = MINOR(inode->i_rdev);
	loff_t n = *ppos;
	unsigned pos = n;
	long viewed, attr, size, written;
	char *con_buf0;
	int col, maxcol;


	size = vcs_size(inode);
	ret = -EINVAL;
	if (pos != n || pos > size)
		goto unlock_out;
	if (count > size - pos)
		count = size - pos;

		if (org0)
			update_region(currcons, (unsigned long)(org0), org-org0);
	}
	*ppos = pos;
	ret = written;

unlock_out:

Lines 33-53 Link Here

(-)linux-2.4.21/drivers/gsc/eisa_eeprom.c (-4 / +10 lines)
33	{	33	{
34	unsigned char *tmp;	34	unsigned char *tmp;
35	ssize_t ret;	35	ssize_t ret;
		36	loff_t n = *ppos;
		37	unsigned pos = n;
36	int i;	38	int i;
37		39
38	if (*ppos >= HPEE_MAX_LENGTH)	40	if (pos != n \|\| pos >= HPEE_MAX_LENGTH)
39	return 0;	41	return 0;
40		42
41	count = ppos + count < HPEE_MAX_LENGTH ? count : HPEE_MAX_LENGTH - ppos;	43	if (count > HPEE_MAX_LENGTH - pos)
		44	count = HPEE_MAX_LENGTH - pos;
		45
42	tmp = kmalloc(count, GFP_KERNEL);	46	tmp = kmalloc(count, GFP_KERNEL);
43	if (tmp) {	47	if (tmp) {
44	for (i = 0; i < count; i++)	48	for (i = 0; i < count; i++)
45	tmp[i] = gsc_readb(eeprom_addr+(*ppos)++);	49	tmp[i] = gsc_readb(eeprom_addr+pos++);
46		50
47	if (copy_to_user (buf, tmp, count))	51	if (copy_to_user (buf, tmp, count))
48	ret = -EFAULT;	52	ret = -EFAULT;
49	else	53	else {
50	ret = count;	54	ret = count;
		55	*ppos = pos;
		56	}
51	kfree (tmp);	57	kfree (tmp);
52	} else	58	} else
53	ret = -ENOMEM;	59	ret = -ENOMEM;




		retval = -EFAULT;
		goto exit;
	}
	*offset = len;
	retval = len;

exit:

		retval = -EFAULT;
		goto exit;
	}
	*offset = len;
	retval = len;

exit:

	int retval;
	int len;
	u8 value;
	loff_t off = *offset;

	dbg("count = %d, offset = %lld\n", count, off);

	if (off < 0)
		return -EINVAL;
	if (count <= 0)
		return 0;
	if (off != 0)
		return 0;

	if (slot == NULL) {

		retval = -EFAULT;
		goto exit;
	}
	*offset = off + len;
	retval = len;

exit:

	int retval;
	int len;
	u8 value;
	loff_t off = *offset;

	dbg("count = %d, offset = %lld\n", count, off);

	if (off < 0)
		return -EINVAL;
	if (count <= 0)
		return 0;
	if (off != 0)
		return 0;

	if (slot == NULL) {

		retval = -EFAULT;
		goto exit;
	}
	*offset = off + len;
	retval = len;

exit:

	int retval;
	int len = 0;
	enum pci_bus_speed value;
	loff_t off = *offset;
	
	dbg ("count = %d, offset = %lld\n", count, off);

	if (off < 0)
		return -EINVAL;
	if (count <= 0)
		return 0;
	if (off != 0)
		return 0;

	if (slot == NULL) {

		retval = -EFAULT;
		goto exit;
	}
	*offset = off + len;
	retval = len;

exit:

	int retval;
	int len = 0;
	enum pci_bus_speed value;
	loff_t off = *offset;

	dbg ("count = %d, offset = %lld\n", count, off);

	if (off < 0)
		return -EINVAL;
	if (count <= 0)
		return 0;
	if (off != 0)
		return 0;

	if (slot == NULL) {

		retval = -EFAULT;
		goto exit;
	}
	*offset = off + len;
	retval = len;

exit:




        ssize_t retval;
        void *membase;

	if (!count)
		return 0;
	if (off < 0)
		return -EINVAL;
	if (off > PCILYNX_MAX_MEMORY)
                return -ENOSPC;
        if (count > PCILYNX_MAX_MEMORY + 1 - off)
                count = PCILYNX_MAX_MEMORY + 1 - off;

        switch (md->type) {
        case rom:


        if (count < mem_mindma) {
                memcpy_fromio(md->lynx->mem_dma_buffer, membase+off, count);
		off += count;
                goto out;
        }


        if (bcount) {
                memcpy_fromio(md->lynx->mem_dma_buffer + count - bcount,
                              membase+off, bcount);
		off += bcount;
        }

 out:

        up(&md->lynx->mem_dma_mutex);

        if (retval < 0) return retval;
        *offset = off;
        return count;
}


                         loff_t *offset)
{
        struct memdata *md = (struct memdata *)file->private_data;
	loff_t off = *offset;

	if (!count)
		return 0;
	if (off < PCILYNX_MAX_MEMORY)
		return -EINVAL;
	if (off > PCILYNX_MAX_MEMORY)
		return -ENOSPC;

        if (count) > PCILYNX_MAX_MEMORY + 1 - off)
                count = PCILYNX_MAX_MEMORY + 1 - off;

        /* FIXME: dereferencing pointers to PCI mem doesn't work everywhere */
        switch (md->type) {
        case aux:
                copy_from_user(md->lynx->aux_port+off, buffer, count);
                break;
        case ram:
                copy_from_user(md->lynx->local_ram+off, buffer, count);
                break;
        case rom:
                /* the ROM may be writeable */
                copy_from_user(md->lynx->local_rom+off, buffer, count);
                break;
        }

        *offset = off + count;
        return count;
}
#endif /* CONFIG_IEEE1394_PCILYNX_PORTS */

Lines 80-85 Link Here

(-)linux-2.4.21/drivers/isdn/divert/divert_procfs.c (-1 / +2 lines)
80	isdn_divert_read(struct file file, char buf, size_t count, loff_t * off)	80	isdn_divert_read(struct file file, char buf, size_t count, loff_t * off)
81	{	81	{
82	struct divert_info *inf;	82	struct divert_info *inf;
		83	loff_t pos = *off;
83	int len;	84	int len;
84		85
85	if (!((struct divert_info *) file->private_data)) {	86	if (!((struct divert_info *) file->private_data)) {
Lines 95-101 Link Here
95	if ((len = strlen(inf->info_start)) <= count) {	96	if ((len = strlen(inf->info_start)) <= count) {
96	if (copy_to_user(buf, inf->info_start, len))	97	if (copy_to_user(buf, inf->info_start, len))
97	return -EFAULT;	98	return -EFAULT;
98	file->f_pos += len;	99	*off = pos + len;
99	return (len);	100	return (len);
100	}	101	}
101	return (0);	102	return (0);




static ssize_t
hysdn_conf_read(struct file *file, char *buf, size_t count, loff_t * off)
{
	loff_t pos = *off;
	char *cp;
	int i;

	if (off != &file->f_pos)	/* fs error check */
		return -ESPIPE;

	if (!(cp = file->private_data))
		return (-EFAULT);	/* should never happen */
	i = strlen(cp);	/* get total string length */
	if (pos == (unsigned)pos && pos < i) {
		/* still bytes to transfer */
		cp += pos;	/* point to desired data offset */
		i -= pos;	/* remaining length */
		if (i > count)
			i = count;	/* limit length to transfer */
		if (copy_to_user(buf, cp, i))
			return (-EFAULT);	/* copy error */
		*off = pos + i;	/* adjust offset */
			*off += i;	/* adjust offset */
		} else
			return (0);
	} else
		return (0);

	return (i);
}				/* hysdn_conf_read */

Lines 210-215 Link Here

(-)linux-2.4.21/drivers/isdn/hysdn/hysdn_proclog.c (-1 / +2 lines)
210	word ino;	210	word ino;
211	struct procdata *pd = NULL;	211	struct procdata *pd = NULL;
212	hysdn_card *card;	212	hysdn_card *card;
		213	loff_t pos = *off;
213		214
214	if (!((struct log_data *) file->private_data)) {	215	if (!((struct log_data *) file->private_data)) {
215	if (file->f_flags & O_NONBLOCK)	216	if (file->f_flags & O_NONBLOCK)
Lines 238-244 Link Here
238	if ((len = strlen(inf->log_start)) <= count) {	239	if ((len = strlen(inf->log_start)) <= count) {
239	if (copy_to_user(buf, inf->log_start, len))	240	if (copy_to_user(buf, inf->log_start, len))
240	return -EFAULT;	241	return -EFAULT;
241	file->f_pos += len;	242	*off = pos + len;
242	return (len);	243	return (len);
243	}	244	}
244	return (0);	245	return (0);





	if ( verify_area(VERIFY_READ, buf, count) )
		return -EFAULT;
	while (count--) {
	{
		char c;
		if (__get_user(c, p++))
			return -EFAULT;
		anslcd_write_byte_data( c );
	}
	*ppos += p - buf;
	return p - buf;
}





static ssize_t read_nvram(struct file *file, char *buf,
			  size_t count, loff_t *ppos)
{
	loff_t n = *ppos;
	unsigned int i = n;
	char *p = buf;

	if (verify_area(VERIFY_WRITE, buf, count))
		return -EFAULT;
	if (i != n || i >= NVRAM_SIZE)
		return 0;
	for (; count > 0 && i < NVRAM_SIZE; ++i, ++p, --count)
		if (__put_user(nvram_read_byte(i), p))
			return -EFAULT;
	*ppos = i;

static ssize_t write_nvram(struct file *file, const char *buf,
			   size_t count, loff_t *ppos)
{
	loff_t n = *ppos;
	unsigned int i = n;
	const char *p = buf;
	char c;

	if (verify_area(VERIFY_READ, buf, count))
		return -EFAULT;
	if (i != n || i >= NVRAM_SIZE)
		return 0;
	for (; count > 0 && i < NVRAM_SIZE; ++i, ++p, --count) {
		if (__get_user(c, p))
			return -EFAULT;
		nvram_write_byte(c, i);

Lines 125-135 Link Here

(-)linux-2.4.21/drivers/mtd/mtdchar.c (-9 / +18 lines)
125	int ret=0;	125	int ret=0;
126	int len;	126	int len;
127	char *kbuf;	127	char *kbuf;
		128	loff_t n = *ppos;
		129	unsigned long pos = n;
128		130
129	DEBUG(MTD_DEBUG_LEVEL0,"MTD_read\n");	131	DEBUG(MTD_DEBUG_LEVEL0,"MTD_read\n");
130		132
131	if (*ppos + count > mtd->size)	133	if (n != pos \|\| pos > mtd->size)
132	count = mtd->size - *ppos;	134	return 0;
		135
		136	if (count > mtd->size - pos)
		137	count = mtd->size - pos;
133		138
134	if (!count)	139	if (!count)
135	return 0;	140	return 0;
Lines 146-154 Link Here
146	if (!kbuf)	151	if (!kbuf)
147	return -ENOMEM;	152	return -ENOMEM;
148		153
149	ret = MTD_READ(mtd, *ppos, len, &retlen, kbuf);	154	ret = MTD_READ(mtd, pos, len, &retlen, kbuf);
150	if (!ret) {	155	if (!ret) {
151	*ppos += retlen;	156	pos += retlen;
152	if (copy_to_user(buf, kbuf, retlen)) {	157	if (copy_to_user(buf, kbuf, retlen)) {
153	kfree(kbuf);	158	kfree(kbuf);
154	return -EFAULT;	159	return -EFAULT;
Lines 166-171 Link Here
166		171
167	kfree(kbuf);	172	kfree(kbuf);
168	}	173	}
		174	*ppos = pos;
169		175
170	return total_retlen;	176	return total_retlen;
171	} /* mtd_read */	177	} /* mtd_read */
Lines 176-191 Link Here
176	char *kbuf;	182	char *kbuf;
177	size_t retlen;	183	size_t retlen;
178	size_t total_retlen=0;	184	size_t total_retlen=0;
		185	loff_t n = *ppos;
		186	unsigned long pos = n;
179	int ret=0;	187	int ret=0;
180	int len;	188	int len;
181		189
182	DEBUG(MTD_DEBUG_LEVEL0,"MTD_write\n");	190	DEBUG(MTD_DEBUG_LEVEL0,"MTD_write\n");
183		191
184	if (*ppos == mtd->size)	192	if (n != pos \|\| pos >= mtd->size)
185	return -ENOSPC;	193	return -ENOSPC;
186		194
187	if (*ppos + count > mtd->size)	195	if (count > mtd->size - pos)
188	count = mtd->size - *ppos;	196	count = mtd->size - pos;
189		197
190	if (!count)	198	if (!count)
191	return 0;	199	return 0;
Lines 207-215 Link Here
207	return -EFAULT;	215	return -EFAULT;
208	}	216	}
209		217
210	ret = ((mtd->write))(mtd, ppos, len, &retlen, kbuf);	218	ret = (*(mtd->write))(mtd, pos, len, &retlen, kbuf);
211	if (!ret) {	219	if (!ret) {
212	*ppos += retlen;	220	pos += retlen;
213	total_retlen += retlen;	221	total_retlen += retlen;
214	count -= retlen;	222	count -= retlen;
215	buf += retlen;	223	buf += retlen;
Lines 221-226 Link Here
221		229
222	kfree(kbuf);	230	kfree(kbuf);
223	}	231	}
		232	*ppos = pos;
224		233
225	return total_retlen;	234	return total_retlen;
226	} /* mtd_write */	235	} /* mtd_write */




ssize_t oprofilefs_str_to_user(char const * str, char * buf, size_t count, loff_t * offset)
{
	size_t len = strlen(str);
	loff_t n = *offset;
	unsigned pos = n;

	if (!count)
		return 0;

	if (pos != n || pos > len)
		return 0;

	if (count > len - pos)
		count = len - pos;

	if (copy_to_user(buf, str + pos, count))
		return -EFAULT;

	*offset = pos + count;

	return count;
}

{
	char tmpbuf[TMPBUFSIZE];
	size_t maxlen;
	loff_t n = *offset;
	unsigned pos = n;

	if (!count)
		return 0;

	maxlen = snprintf(tmpbuf, TMPBUFSIZE, "%lu\n", *val);

	if (pos !=n || pos > maxlen)
		return 0;

	if (count > maxlen - pos)
		count = maxlen - pos;

	if (copy_to_user(buf, tmpbuf + pos, count))
		return -EFAULT;

	*offset = pos + count;

	return count;
}




	const struct inode *ino = file->f_dentry->d_inode;
	const struct proc_dir_entry *dp = ino->u.generic_ip;
	struct pci_dev *dev = dp->data;
	loff_t n = *ppos;
	unsigned pos = n;
	unsigned int cnt, size;

	/*

	else
		size = 64;

	if (pos != n || pos >= size)
		return 0;
	if (nbytes >= size)
		nbytes = size;

	const struct inode *ino = file->f_dentry->d_inode;
	const struct proc_dir_entry *dp = ino->u.generic_ip;
	struct pci_dev *dev = dp->data;
	loff_t n = *ppos;
	unsigned pos = n;
	int cnt;

	if (pos != n || pos >= PCI_CFG_SPACE_SIZE)
		return 0;
	if (nbytes > PCI_CFG_SPACE_SIZE - pos)
		nbytes = PCI_CFG_SPACE_SIZE;
	if (pos + nbytes > PCI_CFG_SPACE_SIZE)
		nbytes = PCI_CFG_SPACE_SIZE - pos;
	cnt = nbytes;





				      size_t count, loff_t * offset)
{
	isapnp_info_buffer_t *buf;
	loff_t pos = *offset;
	long size = 0, size1;
	int mode;


	buf = (isapnp_info_buffer_t *) file->private_data;
	if (!buf)
		return -EIO;
	if (pos != (unsigned)pos || pos >= buf->size)
		return 0;
	size = buf->size < count ? buf->size : count;
	size1 = buf->size - pos;
	if (size1 < size)
		size = size1;
	if (copy_to_user(buffer, buf->buffer + pos, size))
		return -EFAULT;
	*offset = pos + size;
	return size;
}


{
	isapnp_info_buffer_t *buf;
	long size = 0, size1;
	loff_t pos = *offset;
	int mode;

	mode = file->f_flags & O_ACCMODE;

	buf = (isapnp_info_buffer_t *) file->private_data;
	if (!buf)
		return -EIO;
	if (pos < 0)
		return -EINVAL;
	if (pos >= buf->len)
		return -ENOMEM;
	size = buf->len < count ? buf->len : count;
	size1 = buf->len - pos;
	if (size1 < size)
		size = size1;
	if (copy_from_user(buf->buffer + pos, buffer, size))
		return -EFAULT;
	if (buf->size < pos + size)
		buf->size = pos + size;
	*offset = pos + size;
	return size;
}


	struct inode *ino = file->f_dentry->d_inode;
	struct proc_dir_entry *dp = ino->u.generic_ip;
	struct pci_dev *dev = dp->data;
	loff_t n = *ppos;
	unsigned pos = n;
	int cnt, size = 256;

	if (pos != n || pos >= size)
		return 0;
	if (nbytes > size - pos)
		nbytes = size;
	if (pos + nbytes > size)
		nbytes = size - pos;
	cnt = nbytes;





		   loff_t * offset)
{
	loff_t len;
	loff_t n = *offset;
	unsigned pos = n;
	tempinfo_t *p_info = (tempinfo_t *) file->private_data;

	if (n != pos || pos >= p_info->len) {
		return 0;	/* EOF */
	} else {
		len = MIN (user_len, (p_info->len - pos));
		if (copy_to_user (user_buf, &(p_info->data[pos]), len))
			return -EFAULT;
		*offset = pos + len;
		return len;	/* number of bytes "read" */
	}
}

Lines 159-164 Link Here

(-)linux-2.4.21/drivers/s390/char/tape_char.c (-3 / +9 lines)
159	struct tape_device *device;	159	struct tape_device *device;
160	struct tape_request *request;	160	struct tape_request *request;
161	size_t block_size;	161	size_t block_size;
		162	loff_t pos = *ppos;
162	int rc;	163	int rc;
163		164
164	DBF_EVENT(6, "TCHAR:read\n");	165	DBF_EVENT(6, "TCHAR:read\n");
Lines 208-218 Link Here
208	if (rc == 0) {	209	if (rc == 0) {
209	rc = block_size - device->devstat.rescnt;	210	rc = block_size - device->devstat.rescnt;
210	DBF_EVENT(6, "TCHAR:rbytes: %x\n", rc);	211	DBF_EVENT(6, "TCHAR:rbytes: %x\n", rc);
211	filp->f_pos += rc;	212	pos += rc;
212	/* Copy data from idal buffer to user space. */	213	/* Copy data from idal buffer to user space. */
213	if (idal_buffer_to_user(device->char_data.idal_buf,	214	if (idal_buffer_to_user(device->char_data.idal_buf,
214	data, rc) != 0)	215	data, rc) != 0)
215	rc = -EFAULT;	216	rc = -EFAULT;
		217	else
		218	*ppos = pos;
216	}	219	}
217	tape_put_request(request);	220	tape_put_request(request);
218	return rc;	221	return rc;
Lines 224-229 Link Here
224	ssize_t	227	ssize_t
225	tapechar_write(struct file filp, const char data, size_t count, loff_t *ppos)	228	tapechar_write(struct file filp, const char data, size_t count, loff_t *ppos)
226	{	229	{
		230	loff_t pos = *ppos;
227	struct tape_device *device;	231	struct tape_device *device;
228	struct tape_request *request;	232	struct tape_request *request;
229	size_t block_size;	233	size_t block_size;
Lines 275-281 Link Here
275	break;	279	break;
276	DBF_EVENT(6, "TCHAR:wbytes: %lx\n",	280	DBF_EVENT(6, "TCHAR:wbytes: %lx\n",
277	block_size - device->devstat.rescnt);	281	block_size - device->devstat.rescnt);
278	filp->f_pos += block_size - device->devstat.rescnt;	282	pos += block_size - device->devstat.rescnt;
279	written += block_size - device->devstat.rescnt;	283	written += block_size - device->devstat.rescnt;
280	if (device->devstat.rescnt != 0)	284	if (device->devstat.rescnt != 0)
281	break;	285	break;
Lines 301-308 Link Here
301	* Since process_eov positions the tape in front of the written	305	* Since process_eov positions the tape in front of the written
302	* tapemark it doesn't hurt to write two marks again.	306	* tapemark it doesn't hurt to write two marks again.
303	*/	307	*/
304	if(!rc)	308	if(!rc) {
305	device->required_tapemarks = 2;	309	device->required_tapemarks = 2;
		310	*ppos = pos;
		311	}
306		312
307	return rc ? rc : written;	313	return rc ? rc : written;
308	}	314	}




	file->private_data = kmalloc(CTRL_BUFSIZE, GFP_KERNEL);
	if (file->private_data == NULL)
		return -ENOMEM;
	*(char *)file->private_data = '\0';
	MOD_INC_USE_COUNT;
	return 0;
}

	ctc_priv *privptr;
	ssize_t ret = 0;
	char *p = sbuf;
	loff_t pos = *off;
	int l;

	if (!(dev = find_netdev_by_ino(ino)))


	privptr = (ctc_priv *)dev->priv;

	if (!*sbuf || pos == 0)
		sprintf(sbuf, "%d\n", privptr->channel[READ]->max_bufsize);

	l = strlen(sbuf);
	p = sbuf;
	if (pos == (unsigned)pos && pos < l) {
		p += pos;
		l = strlen(p);
		ret = (count > l) ? l : count;
		if (copy_to_user(buf, p, ret))
			return -EFAULT;
		*off = pos + ret;
	}
	file->f_pos += ret;
	return ret;
}


	file->private_data = kmalloc(STATS_BUFSIZE, GFP_KERNEL);
	if (file->private_data == NULL)
		return -ENOMEM;
	*(char *)file->private_data = '\0';
	MOD_INC_USE_COUNT;
	return 0;
}

	ctc_priv *privptr;
	ssize_t ret = 0;
	char *p = sbuf;
	loff_t pos = *off;
	int l;

	if (!(dev = find_netdev_by_ino(ino)))


	privptr = (ctc_priv *)dev->priv;

	if (!*sbuf || pos == 0) {
		p += sprintf(p, "Device FSM state: %s\n",
			     fsm_getstate_str(privptr->fsm));
		p += sprintf(p, "RX channel FSM state: %s\n",

	}
	l = strlen(sbuf);
	p = sbuf;
	if (pos == (unsigned)pos && pos < l) {
		p += pos;
		l = strlen(p);
		ret = (count > l) ? l : count;
		if (copy_to_user(buf, p, ret))
			return -EFAULT;
		*off = pos + ret;
	}
	file->f_pos += ret;
	return ret;
}





	file->private_data = kmalloc(CTRL_BUFSIZE, GFP_KERNEL);
	if (file->private_data == NULL)
		return -ENOMEM;
	*(char *)file->private_data = '\0';
	MOD_INC_USE_COUNT;
	return 0;
}

	netiucv_priv *privptr;
	ssize_t ret = 0;
	char *p = sbuf;
	loff_t pos = *ppos;
	int l;

	if (!(dev = find_netdev_by_ino(ino)))


	privptr = (netiucv_priv *)dev->priv;

	if (!*sbuf || pos == 0)
		sprintf(sbuf, "%d\n", privptr->conn->max_buffsize);

	l = strlen(sbuf);
	p = sbuf;
	if (pos == (unsigned)pos && pos < l) {
		p += pos;
		l = strlen(p);
		ret = (count > l) ? l : count;
		if (copy_to_user(buf, p, ret))
			return -EFAULT;
	}
	pos += ret;
	*ppos = pos;
	return ret;
}


	file->private_data = kmalloc(CTRL_BUFSIZE, GFP_KERNEL);
	if (file->private_data == NULL)
		return -ENOMEM;
	*(char *)file->private_data = '\0';
	MOD_INC_USE_COUNT;
	return 0;
}

	netiucv_priv *privptr;
	ssize_t ret = 0;
	char *p = sbuf;
	loff_t pos = *ppos;
	int l;

	if (!(dev = find_netdev_by_ino(ino)))

	privptr = (netiucv_priv *)dev->priv;


	if (!*sbuf || pos == 0)
		sprintf(sbuf, "%s\n",
			netiucv_printname(privptr->conn->userid));

	l = strlen(sbuf);
	p = sbuf;
	if (pos == (unsigned)pos && pos < l) {
		p += pos;
		l = strlen(p);
		ret = (count > l) ? l : count;
		if (copy_to_user(buf, p, ret))
			return -EFAULT;
		*ppos = pos + ret;
	}
	file->f_pos += ret;
	return ret;
}


	file->private_data = kmalloc(STATS_BUFSIZE, GFP_KERNEL);
	if (file->private_data == NULL)
		return -ENOMEM;
	*(char *)file->private_data = '\0';
	MOD_INC_USE_COUNT;
	return 0;
}

netiucv_stat_read(struct file *file, char *buf, size_t count, loff_t *off)
{
	unsigned int ino = ((struct inode *)file->f_dentry->d_inode)->i_ino;
	loff_t pos = *ppos;
	char *sbuf = (char *)file->private_data;
	net_device *dev;
	netiucv_priv *privptr;


	privptr = (netiucv_priv *)dev->priv;

	if (!*sbuf || pos == 0) {
		p += sprintf(p, "Device FSM state: %s\n",
			     fsm_getstate_str(privptr->fsm));
		p += sprintf(p, "Connection FSM state: %s\n",

	}
	l = strlen(sbuf);
	p = sbuf;
	if (pos == (unsigned)pos && pos < l) {
		p += pos;
		l = strlen(p);
		ret = (count > l) ? l : count;
		if (copy_to_user(buf, p, ret))
			return -EFAULT;
		*ppos = pos + ret;
	}
	file->f_pos += ret;
	return ret;
}


Lines 9891-9897 Link Here

(-)linux-2.4.21/drivers/s390/net/qeth.c (-7 / +9 lines)
9891	int pos=0,end_pos;	9891	int pos=0,end_pos;
9892	char dbf_text[15];	9892	char dbf_text[15];
9893		9893
9894	if (*offset>0) return user_len;	9894	if (*offset) return user_len;
9895	buffer=vmalloc(__max(user_len+1,QETH_DBF_MISC_LEN));	9895	buffer=vmalloc(__max(user_len+1,QETH_DBF_MISC_LEN));
9896	if (buffer == NULL)	9896	if (buffer == NULL)
9897	return -ENOMEM;	9897	return -ENOMEM;
Lines 10407-10420 Link Here
10407	{	10407	{
10408	loff_t len;	10408	loff_t len;
10409	tempinfo_t p_info = (tempinfo_t ) file->private_data;	10409	tempinfo_t p_info = (tempinfo_t ) file->private_data;
		10410	loff_t n = *offset;
		10411	unsigned long pos = n;
10410		10412
10411	if (*offset >= p_info->len) {	10413	if (pos != n \|\| pos >= p_info->len) {
10412	return 0;	10414	return 0;
10413	} else {	10415	} else {
10414	len = __min(user_len, (p_info->len - *offset));	10416	len = __min(user_len, (p_info->len - pos));
10415	if (copy_to_user (user_buf, &(p_info->data[*offset]), len))	10417	if (copy_to_user (user_buf, &(p_info->data[pos]), len))
10416	return -EFAULT;	10418	return -EFAULT;
10417	(*offset) += len;	10419	*offset = pos + len;
10418	return len;	10420	return len;
10419	}	10421	}
10420	}	10422	}
Lines 10449-10455 Link Here
10449	qeth_card_t *card;	10451	qeth_card_t *card;
10450	#define BUFFER_LEN (10+32+1+5+1+DEV_NAME_LEN+1)	10452	#define BUFFER_LEN (10+32+1+5+1+DEV_NAME_LEN+1)
10451		10453
10452	if (*offset>0) return user_len;	10454	if (*offset) return user_len;
10453	buffer=vmalloc(__max(__max(user_len+1,BUFFER_LEN),QETH_DBF_MISC_LEN));	10455	buffer=vmalloc(__max(__max(user_len+1,BUFFER_LEN),QETH_DBF_MISC_LEN));
10454		10456
10455	if (buffer == NULL)	10457	if (buffer == NULL)
Lines 10573-10579 Link Here
10573	PRINT_ERR("unknown ipato information command\n");	10575	PRINT_ERR("unknown ipato information command\n");
10574	out:	10576	out:
10575	vfree(buffer);	10577	vfree(buffer);
10576	offset = offset + user_len;	10578	*offset = user_len;
10577	#undef BUFFER_LEN	10579	#undef BUFFER_LEN
10578	return user_len;	10580	return user_len;
10579	}	10581	}

Lines 8545-8558 Link Here

(-)linux-2.4.21/drivers/s390/s390io.c (-8 / +12 lines)
8545	{	8545	{
8546	loff_t len;	8546	loff_t len;
8547	tempinfo_t p_info = (tempinfo_t ) file->private_data;	8547	tempinfo_t p_info = (tempinfo_t ) file->private_data;
		8548	loff_t n = *offset;
		8549	unsigned long pos = n;
8548		8550
8549	if (*offset >= p_info->len) {	8551	if (pos != n \|\| pos >= p_info->len) {
8550	return 0;	8552	return 0;
8551	} else {	8553	} else {
8552	len = MIN (user_len, (p_info->len - *offset));	8554	len = MIN (user_len, (p_info->len - pos));
8553	if (copy_to_user (user_buf, &(p_info->data[*offset]), len))	8555	if (copy_to_user (user_buf, &(p_info->data[pos]), len))
8554	return -EFAULT;	8556	return -EFAULT;
8555	(*offset) += len;	8557	*offset = pos + len;
8556	return len;	8558	return len;
8557	}	8559	}
8558	}	8560	}
Lines 9340-9353 Link Here
9340	{	9342	{
9341	loff_t len;	9343	loff_t len;
9342	tempinfo_t p_info = (tempinfo_t ) file->private_data;	9344	tempinfo_t p_info = (tempinfo_t ) file->private_data;
		9345	loff_t n = *offset;
		9346	unsigned long pos = n;
9343		9347
9344	if ( *offset>=p_info->len) {	9348	if ( n != pos \|\| pos >= p_info->len) {
9345	return 0;	9349	return 0;
9346	} else {	9350	} else {
9347	len = MIN(user_len, (p_info->len - *offset));	9351	len = MIN(user_len, (p_info->len - pos));
9348	if (copy_to_user( user_buf, &(p_info->data[*offset]), len))	9352	if (copy_to_user( user_buf, &(p_info->data[pos]), len))
9349	return -EFAULT;	9353	return -EFAULT;
9350	(* offset) += len;	9354	*offset = pos + len;
9351	return len;	9355	return len;
9352	}	9356	}
9353	}	9357	}




        
	loff_t len;
	procbuf_t *pbuf = (procbuf_t *) file->private_data;
	loff_t pos = *offset;

	ZFCP_LOG_TRACE(
          "enter (file=0x%lx  user_buf=0x%lx "

          (unsigned long)file,
          (unsigned long)user_buf,
          user_len,
          (unsigned long)pos);

	if (pos != (unsigned long)pos || pos >= pbuf->len) {
		return 0;
	} else {
		len = min(user_len, (unsigned long)(pbuf->len - pos));
		if (copy_to_user( user_buf, &(pbuf->buf[pos]), len))
			return -EFAULT;
		*offset = pos + len;
		return len;
	}

        ZFCP_LOG_TRACE("Size-offset is %ld, user_len is %ld\n ",
                       ((unsigned long)(pbuf->len  - pos)),
                       user_len);

        ZFCP_LOG_TRACE("exit (%Li)\n", len);

     zfcp_adapter_t *adapter=NULL;
     zfcp_port_t *port=NULL;
     zfcp_unit_t *unit=NULL;
     loff_t pos = *offset;
     
     /* Is used when we don't have a 0 offset, which cannot happen
      * during the first call

          (unsigned long)file,
          (unsigned long)user_buf,
          user_len,
          pos);

     /* Do not overwrite proc-buffer */
     user_len = min(user_len, ZFCP_MAX_PROC_SIZE);
     size=0;
     if(pos==0) {
             current_unit=0;
             line_offset=0;
     } else {
		current_unit = pos;
		line_offset = do_div(current_unit, item_size);
             ZFCP_LOG_TRACE("item_size %ld, current_unit %Ld, line_offset %Ld\n",
                            item_size,

     }

 out:        
     *offset = pos + user_len;

     ZFCP_LOG_TRACE("exit (%li)\n", user_len);



        loff_t len;
        procbuf_t *pbuf = (procbuf_t *) file->private_data;
	loff_t pos = *offset;

        ZFCP_LOG_TRACE(
          "enter (file=0x%lx  user_buf=0x%lx "

          (unsigned long)file,
          (unsigned long)user_buf,
          user_len,
          (unsigned long)pos);

        if ( pos != (unsigned long)pos || pos >= pbuf->len) {
                return 0;
        } else {
                len = min(user_len, (unsigned long)(pbuf->len - pos));
                if (copy_to_user( user_buf, &(pbuf->buf[pos]), len))
                        return -EFAULT;
                *offset = pos + len;
                return len;
        }



        loff_t len;
        procbuf_t *pbuf = (procbuf_t *) file->private_data;
	loff_t pos = *offset;

        ZFCP_LOG_TRACE(
          "enter (file=0x%lx  user_buf=0x%lx "

          (unsigned long)file,
          (unsigned long)user_buf,
          user_len,
          (unsigned long)pos);

        if (pos != (unsigned long)pos || pos >= pbuf->len) {
                return 0;
        } else {
                len = min(user_len, (unsigned long)(pbuf->len - pos));
                if (copy_to_user( user_buf, &(pbuf->buf[pos]), len))
                        return -EFAULT;
                *offset = pos + len;
                return len;
        }



        loff_t len;
        procbuf_t *pbuf = (procbuf_t *) file->private_data;
	loff_t pos = *offset;

        ZFCP_LOG_TRACE(
          "enter (file=0x%lx  user_buf=0x%lx "

          (unsigned long)file,
          (unsigned long)user_buf,
          user_len,
          (unsigned long)pos);

        if (pos != (unsigned long)pos || pos >= pbuf->len) {
                return 0;
        } else {
                len = min(user_len, (unsigned long)(pbuf->len - pos));
                if (copy_to_user( user_buf, &(pbuf->buf[pos]), len))
                        return -EFAULT;
                *offset = pos + len;
                return len;
        }

        ZFCP_LOG_TRACE("Size-offset is %ld, user_len is %ld\n ",
                       ((unsigned long)(pbuf->len  - pos)),
                       user_len);

        ZFCP_LOG_TRACE("exit (%Li)\n", len);

Lines 105-113 Link Here

(-)linux-2.4.21/drivers/sbus/char/flash.c (-2 / +5 lines)
105	flash_read(struct file * file, char * buf,	105	flash_read(struct file * file, char * buf,
106	size_t count, loff_t *ppos)	106	size_t count, loff_t *ppos)
107	{	107	{
108	unsigned long p = file->f_pos;	108	unsigned long p = *ppos;
109	int i;	109	int i;
110		110
		111	if (p > flash.read_size)
		112	return 0;
		113
111	if (count > flash.read_size - p)	114	if (count > flash.read_size - p)
112	count = flash.read_size - p;	115	count = flash.read_size - p;
113		116
Lines 118-124 Link Here
118	buf++;	121	buf++;
119	}	122	}
120		123
121	file->f_pos += count;	124	*ppos = p + count;
122	return count;	125	return count;
123	}	126	}
124		127




	ST_mode * STm;
	ST_partstat * STps;
	int dev = TAPE_NR(inode->i_rdev);
	loff_t pos = *ppos;

	STp = os_scsi_tapes[dev];


		if (i == (-ENOSPC)) {
			transfer = STp->buffer->writing;	/* FIXME -- check this logic */
			if (transfer <= do_count) {
				pos += do_count - transfer;
				count -= do_count - transfer;
				if (STps->drv_block >= 0) {
					STps->drv_block += (do_count - transfer) / STp->block_size;

			goto out;
		}

		pos += do_count;
		b_point += do_count;
		count -= do_count;
		if (STps->drv_block >= 0) {

		if (STps->drv_block >= 0) {
			STps->drv_block += blks;
		}
		pos += count;
		count = 0;
	}


	retval = total;

out:
	*ppos = pos;
	if (SRpnt != NULL) scsi_release_request(SRpnt);

	up(&STp->lock);

	ST_partstat * STps;
	Scsi_Request *SRpnt = NULL;
	int dev = TAPE_NR(inode->i_rdev);
	loff_t pos = *ppos;

	STp = os_scsi_tapes[dev];


			}
			STp->logical_blk_num += transfer / STp->block_size;
			STps->drv_block      += transfer / STp->block_size;
			pos                  += transfer;
			buf                  += transfer;
			total                += transfer;
		}

	retval = total;

out:
	*ppos = pos;
	if (SRpnt != NULL) scsi_release_request(SRpnt);

	up(&STp->lock);

Lines 1202-1207 Link Here

(-)linux-2.4.21/drivers/scsi/st.c (-4 / +9 lines)
1202	ST_mode *STm;	1202	ST_mode *STm;
1203	ST_partstat *STps;	1203	ST_partstat *STps;
1204	int dev = TAPE_NR(inode->i_rdev);	1204	int dev = TAPE_NR(inode->i_rdev);
		1205	loff_t pos = *ppos;
		1206	loff_t pos = *ppos;
1205		1207
1206	read_lock(&st_dev_arr_lock);	1208	read_lock(&st_dev_arr_lock);
1207	STp = scsi_tapes[dev];	1209	STp = scsi_tapes[dev];
Lines 1433-1439 Link Here
1433	residual *= STp->block_size;	1435	residual *= STp->block_size;
1434	if (residual <= do_count) {	1436	if (residual <= do_count) {
1435	/* Within the data in this write() */	1437	/* Within the data in this write() */
1436	filp->f_pos += do_count - residual;	1438	pos += do_count - residual;
1437	count -= do_count - residual;	1439	count -= do_count - residual;
1438	if (STps->drv_block >= 0) {	1440	if (STps->drv_block >= 0) {
1439	if (STp->block_size == 0 &&	1441	if (STp->block_size == 0 &&
Lines 1489-1495 Link Here
1489	retval = total - count;	1491	retval = total - count;
1490	goto out;	1492	goto out;
1491	}	1493	}
1492	filp->f_pos += do_count;	1494	pos += do_count;
1493	b_point += do_count;	1495	b_point += do_count;
1494	count -= do_count;	1496	count -= do_count;
1495	if (STps->drv_block >= 0) {	1497	if (STps->drv_block >= 0) {
Lines 1508-1514 Link Here
1508	retval = i;	1510	retval = i;
1509	goto out;	1511	goto out;
1510	}	1512	}
1511	filp->f_pos += count;	1513	pos += count;
1512	count = 0;	1514	count = 0;
1513	}	1515	}
1514		1516
Lines 1543-1548 Link Here
1543	retval = total - count;	1545	retval = total - count;
1544		1546
1545	out:	1547	out:
		1548	*ppos = pos;
1546	if (SRpnt != NULL)	1549	if (SRpnt != NULL)
1547	scsi_release_request(SRpnt);	1550	scsi_release_request(SRpnt);
1548	up(&STp->lock);	1551	up(&STp->lock);
Lines 1743-1748 Link Here
1743	ST_mode *STm;	1746	ST_mode *STm;
1744	ST_partstat *STps;	1747	ST_partstat *STps;
1745	int dev = TAPE_NR(inode->i_rdev);	1748	int dev = TAPE_NR(inode->i_rdev);
		1749	loff_t pos = *ppos;
1746		1750
1747	read_lock(&st_dev_arr_lock);	1751	read_lock(&st_dev_arr_lock);
1748	STp = scsi_tapes[dev];	1752	STp = scsi_tapes[dev];
Lines 1887-1893 Link Here
1887	retval = i;	1891	retval = i;
1888	goto out;	1892	goto out;
1889	}	1893	}
1890	filp->f_pos += transfer;	1894	pos += transfer;
1891	buf += transfer;	1895	buf += transfer;
1892	total += transfer;	1896	total += transfer;
1893	}	1897	}
Lines 1917-1922 Link Here
1917	retval = total;	1921	retval = total;
1918		1922
1919	out:	1923	out:
		1924	*ppos = pos;
1920	if (SRpnt != NULL) {	1925	if (SRpnt != NULL) {
1921	scsi_release_request(SRpnt);	1926	scsi_release_request(SRpnt);
1922	SRpnt = NULL;	1927	SRpnt = NULL;

Lines 596-601 Link Here

(-)linux-2.4.21/drivers/usb/brlvger.c (+3 lines)
596		596
597	off = *pos;	597	off = *pos;
598		598
		599	if (off < 0)
		600	return -EINVAL;
		601
599	if(off > priv->plength)	602	if(off > priv->plength)
600	return -ESPIPE;;	603	return -ESPIPE;;
601		604




	struct dev_state *ps = (struct dev_state *)file->private_data;
	ssize_t ret = 0;
	unsigned len;
	loff_t pos, last;
	int i;

	pos = *ppos;

			goto err;
		}

		pos += len;
		buf += len;
		nbytes -= len;
		ret += len;
	}

	last = sizeof(struct usb_device_descriptor);
	for (i = 0; nbytes && i < ps->dev->descriptor.bNumConfigurations; i++) {
		struct usb_config_descriptor *config =
			(struct usb_config_descriptor *)ps->dev->rawdescriptors[i];
		unsigned int length = le16_to_cpu(config->wTotalLength);

		if (pos < last + length) {
			len = length - (pos - last);
			if (len > nbytes)
				len = nbytes;

			if (copy_to_user(buf,
			    ps->dev->rawdescriptors[i] + (pos - last), len)) {
				ret = -EFAULT;
				goto err;
			}

			pos += len;
			buf += len;
			nbytes -= len;
			ret += len;
		}

		last += length;
	}
	*ppos = pos;

err:
	up_read(&ps->devsem);




	struct list_head *tmp = usb_driver_list.next;
	char *page, *start, *end;
	ssize_t ret = 0;
	loff_t n = *ppos;
	unsigned int pos = n, len;

	if (pos != n)
		return -EINVAL;
	if (nbytes <= 0)
		return 0;

                return -ENOMEM;
	start = page;
	end = page + (PAGE_SIZE - 100);
	pos = *ppos;
	for (; tmp != &usb_driver_list; tmp = tmp->next) {
		struct usb_driver *driver = list_entry(tmp, struct usb_driver, driver_list);
		int minor = driver->fops ? driver->minor : -1;

		if (copy_to_user(buf, page + pos, len))
			ret = -EFAULT;
		else
			*ppos = pos + len;
	}
	free_page((unsigned long)page);
	return ret;




			loff_t *ppos)
{
	struct uhci_proc *up = file->private_data;
	loff_t n = *ppos;
	unsigned int pos = n;
	unsigned int size;

	pos = *ppos;
	size = up->size;
	if (pos != n || pos >= size)
		return 0;
	if (nbytes > size - pos)
		nbytes = size;
	if (pos + nbytes > size)
		nbytes = size - pos;

	if (!access_ok(VERIFY_WRITE, buf, nbytes))


	copy_to_user(buf, up->data + pos, nbytes);

	ppos = pos + nbytes;

	return nbytes;
}




	fb->fb_get_fix(&fix,PROC_CONSOLE(info), info);
	if (p >= fix.smem_len)
	    return 0;
	if (count > fix.smem_len - p)
	    count = fix.smem_len;
	if (count + p > fix.smem_len)
		count = fix.smem_len - p;
	if (count) {
	    char *base_addr;

	    count -= copy_to_user(buf, base_addr+p, count);
	    if (!count)
		return -EFAULT;
	    *ppos = p + count;
	}
	return count;
}

	fb->fb_get_fix(&fix, PROC_CONSOLE(info), info);
	if (p > fix.smem_len)
	    return -ENOSPC;
	if (count >= fix.smem_len)
	    count = fix.smem_len;
	err = 0;
	if (count > fix.smem_len - p) {
	    count = fix.smem_len - p;
	    err = -ENOSPC;
	}


	    base_addr = info->disp->screen_base;
	    count -= copy_from_user(base_addr+p, buf, count);
	    *ppos = p + count;
	    err = -EFAULT;
	}
	if (count)




	struct ConfigDev cd;
	loff_t pos = *ppos;

	if (pos < 0 || pos >= sizeof(struct ConfigDev))
		return 0;
	if (nbytes > sizeof(struct ConfigDev) - pos)
		nbytes = sizeof(struct ConfigDev);
	if (pos + nbytes > sizeof(struct ConfigDev))
		nbytes = sizeof(struct ConfigDev) - pos;

	/* Construct a ConfigDev */


	if (copy_to_user(buf, &cd, nbytes))
		return -EFAULT;
	*ppos = pos + nbytes;

	return nbytes;
}




{
    int done = FALSE;
    int ival;
    loff_t pos, devname_offset, tlen, rpos, old_pos;
    devfs_handle_t de;
    struct devfsd_buf_entry *entry;
    struct fs_info *fs_info = file->f_dentry->d_inode->i_sb->u.generic_sbp;

    info->namelen = DEVFS_PATHLEN - pos - 1;
    if (info->mode == 0) info->mode = de->mode;
    devname_offset = info->devname - (char *) info;
    old_pos = rpos = *ppos;
    if (rpos >= 0 && rpos < devname_offset)
    {
	/*  Copy parts of the header  */
	tlen = devname_offset - rpos;

	}
	rpos += tlen;
    }
    tlen = rpos - old_pos;
    if (done)
    {
	devfs_handle_t parent;

			  loff_t *ppos)
{
    ssize_t num;
    loff_t n = *ppos;
    char txt[80];

    num = sprintf (txt, "Number of entries: %u  number of bytes: %u\n",
		   stat_num_entries, stat_num_bytes) + 1;
    /*  Can't seek (pread) on this device  */
    if (ppos != &file->f_pos) return -ESPIPE;
    if (n != (unsigned)n || n >= num) return 0;
    if (len > num - n) len = num - n;
    if ( copy_to_user (buf, txt + n, len) ) return -EFAULT;
    *ppos = n + len;
    return len;
}   /*  End Function stat_read  */
#endif




		return -EINVAL;
	}
	pos = *ppos;
	if (pos < 0 || pos >= HFS_FORK_MAX) {
		return 0;
	}
	size = inode->i_size;

	}
	if ((read = hfs_do_read(inode, HFS_I(inode)->fork, pos,
				buf, left, filp->f_reada != 0)) > 0) {
	        *ppos = pos + read;
		filp->f_reada = 1;
	}



	pos = (filp->f_flags & O_APPEND) ? inode->i_size : *ppos;

	if (pos < 0 || pos >= HFS_FORK_MAX) {
		return 0;
	}
	if (count > HFS_FORK_MAX) {

	        pos += written;

	*ppos = pos;
	if (pos > inode->i_size) {
	        inode->i_size = pos;
		mark_inode_dirty(inode);
	}





				  hfs_rwarg_t count, loff_t *ppos)
{
        struct inode *inode = filp->f_dentry->d_inode;
	hfs_u32 pos, end;

	if (!S_ISREG(inode->i_mode)) {
		hfs_warn("hfs_file_write: mode = %07o\n", inode->i_mode);

		return 0;
	}

	end = pos + count;
	if (end > HFS_FORK_MAX) {
		end = HFS_FORK_MAX;
		count = HFS_FORK_MAX - pos;
	}

	if (end > inode->i_size)
	        inode->i_size = end;

	/* Only deal with the part we store in memory */
	if (pos < sizeof(struct hfs_cap_info)) {

		}
	}

	*ppos = end;
	inode->i_mtime = inode->i_ctime = CURRENT_TIME;
	mark_inode_dirty(inode);
	return count;




	struct hfs_cat_entry *entry = HFS_I(inode)->entry;
	const struct hfs_hdr_layout *layout;
	off_t start, length, offset;
	loff_t pos = *ppos;
	int left, lcv, read = 0;

	if (!S_ISREG(inode->i_mode)) {

	}

	/* Adjust count to fit within the bounds of the file */
	if (pos != (unsigned)pos || pos >= inode->i_size || count <= 0) {
		return 0;
	} else if (count > inode->i_size - pos) {
		count = inode->i_size - pos;

		hfs_warn("hfs_hdr_write: mode = %07o\n", inode->i_mode);
		return -EINVAL;
	}
	if (count <= 0 || pos != (unsigned)pos) {
		return 0;
	}





			    size_t count, loff_t *ppos)
{
	struct inode *inode = file->f_dentry->d_inode;
	loff_t pos = *ppos;
	char buffer[10];
	
	if (count < 0 || !inode->u.generic_ip)
		return -EINVAL;
	sprintf (buffer, "%8.8x\n", (u32)(long)(inode->u.generic_ip));
	if (pos != (unsigned)pos || pos >= 9)
		return 0;
	if (count > 9 - pos)
		count = 9 - pos;
	copy_to_user(buf, buffer + pos, count);
	*ppos = pos + count;
	return count;
}


			     size_t count, loff_t *ppos)
{
	struct inode *inode = filp->f_dentry->d_inode;
	loff_t pos = *ppos;
	int i, j, k;
	u32 node;
	char *p, *s;

	openprom_property *op;
	char buffer[64];
	
	if (pos < 0 || pos >= 0xffffff)
		return -EINVAL;
	if (!filp->private_data) {
		node = nodes[(u16)((long)inode->u.generic_ip)].node;

	} else {
		i = (op->len << 1) + 1;
	}
	k = pos;
	if (k >= i) return 0;
	if (count > i - k) count = i - k;
	if (op->flag & OPP_STRING) {

			j = count;

		if (j >= 0) {
			copy_to_user(buf + k - pos,
				     op->value + k - 1, j);
			count -= j;
			k += j;
		}

		if (count)
			__put_user('\'', &buf [k++ - pos]);
		if (count > 1)
			__put_user('\n', &buf [k++ - pos]);

	} else if (op->flag & OPP_STRINGLIST) {
		char *tmp;


		if ((k < i - 1) && (k & 1)) {
			sprintf (buffer, "%02x", *(op->value + (k >> 1)));
			__put_user(buffer[1], &buf[k++ - pos]);
			count--;
		}

		for (; (count > 1) && (k < i - 1); k += 2) {
			sprintf (buffer, "%02x", *(op->value + (k >> 1)));
			copy_to_user (buf + k - pos, buffer, 2);
			count -= 2;
		}

		if (count && (k < i - 1)) {
			sprintf (buffer, "%02x", *(op->value + (k >> 1)));
			__put_user(buffer[0], &buf[k++ - pos]);
			count--;
		}

		if (count)
			__put_user('\n', &buf [k++ - pos]);
	}
	count = k - pos;
	*ppos = k;
	return count;
}

static ssize_t property_write(struct file *filp, const char *buf,
			      size_t count, loff_t *ppos)
{
	loff_t pos = *ppos;
	int i, j, k;
	char *p;
	u32 *q;
	void *b;
	openprom_property *op;
	
	if (pos < 0 || pos >= 0xffffff)
		return -EINVAL;
	if (!filp->private_data) {
		i = property_read (filp, NULL, 0, 0);
		if (i)
			return i;
	}
	k = pos;
	op = (openprom_property *)filp->private_data;
	if (!(op->flag & OPP_STRING)) {
		u32 *first, *last;

				op->len = i;
		} else
			op->len = i;
		pos += count;
		*ppos = pos;
	}
write_try_string:
	if (!(op->flag & OPP_BINARY)) {

				op->flag |= OPP_QUOTED;
				buf++;
				count--;
				pos++;
				*ppos = pos;
				if (!count) {
					op->flag |= OPP_STRING;
					return 1;

				op->flag |= OPP_NOTQUOTED;
		}
		op->flag |= OPP_STRING;
		if (op->alloclen <= count + pos) {
			b = kmalloc (sizeof (openprom_property)
				     + 2 * (count + pos), GFP_KERNEL);
			if (!b)
				return -ENOMEM;
			memcpy (b, filp->private_data,

				+ strlen (op->name) + op->alloclen);
			memset (((char *)b) + sizeof (openprom_property)
				+ strlen (op->name) + op->alloclen, 
				0, 2*(count - pos) - op->alloclen);
			op = (openprom_property *)b;
			op->alloclen = 2*(count + pos);
			b = filp->private_data;
			filp->private_data = (void *)op;
			kfree (b);
		}
		p = op->value + pos - ((op->flag & OPP_QUOTED) ? 1 : 0);
		copy_from_user (p, buf, count);
		op->flag |= OPP_DIRTY;
		for (i = 0; i < count; i++, p++)

			}
		if (i < count) {
			op->len = p - op->value;
			pos += i + 1;
			*ppos = pos;
			if ((p > op->value) && (op->flag & OPP_QUOTED)
			    && (*(p - 1) == '\''))
				op->len--;
		} else {
			if (p - op->value > op->len)
				op->len = p - op->value;
			pos += count;
			*ppos = pos;
		}
	}
	return pos - k;
}

int property_release (struct inode *inode, struct file *filp)




	struct vm_area_struct * map;
	char *tmp, *kbuf;
	long retval;
	int lineno, loff;
	unsigned off;
	loff_t pos = *ppos;

	/* reject calls with out of range parameters immediately */
	retval = 0;
	off = pos;
	if (off != pos)
		goto out;
	if (count == 0)
		goto out;
	off = (long)*ppos;
	/*
	 * We might sleep getting the page, so get it first.
	 */




	ssize_t length;
	ssize_t end;
	struct task_struct *task = inode->u.proc_i.task;
	loff_t pos = *ppos;

	if (count > PROC_BLOCK_SIZE)
		count = PROC_BLOCK_SIZE;

		return length;
	}
	/* Static 4kB (or whatever) block capacity */
	if (pos < 0 || pos >= length) {
		free_page(page);
		return 0;
	}
	if (count > length - pos)
		count = length - pos;
	end = count + pos;
	copy_to_user(buf, (char *) page + pos, count);
	*ppos = end;
	free_page(page);
	return count;

Lines 56-61 Link Here

(-)linux-2.4.21/fs/proc/generic.c (-5 / +9 lines)
56	ssize_t n, count;	56	ssize_t n, count;
57	char *start;	57	char *start;
58	struct proc_dir_entry * dp;	58	struct proc_dir_entry * dp;
		59	loff_t pos = *ppos;
59		60
60	dp = (struct proc_dir_entry *) inode->u.generic_ip;	61	dp = (struct proc_dir_entry *) inode->u.generic_ip;
61	if (!(page = (char*) __get_free_page(GFP_KERNEL)))	62	if (!(page = (char*) __get_free_page(GFP_KERNEL)))
Lines 64-69 Link Here
64	while ((nbytes > 0) && !eof)	65	while ((nbytes > 0) && !eof)
65	{	66	{
66	count = MIN(PROC_BLOCK_SIZE, nbytes);	67	count = MIN(PROC_BLOCK_SIZE, nbytes);
		68	if ((unsigned)pos > INT_MAX)
		69	break;
67		70
68	start = NULL;	71	start = NULL;
69	if (dp->get_info) {	72	if (dp->get_info) {
Lines 71-81 Link Here
71	* Handle backwards compatibility with the old net	74	* Handle backwards compatibility with the old net
72	* routines.	75	* routines.
73	*/	76	*/
74	n = dp->get_info(page, &start, *ppos, count);	77	n = dp->get_info(page, &start, pos, count);
75	if (n < count)	78	if (n < count)
76	eof = 1;	79	eof = 1;
77	} else if (dp->read_proc) {	80	} else if (dp->read_proc) {
78	n = dp->read_proc(page, &start, *ppos,	81	n = dp->read_proc(page, &start, pos,
79	count, &eof, dp->data);	82	count, &eof, dp->data);
80	} else	83	} else
81	break;	84	break;
Lines 84-91 Link Here
84	/*	87	/*
85	* For proc files that are less than 4k	88	* For proc files that are less than 4k
86	*/	89	*/
87	start = page + *ppos;	90	start = page + pos;
88	n -= *ppos;	91	n -= pos;
89	if (n <= 0)	92	if (n <= 0)
90	break;	93	break;
91	if (n > count)	94	if (n > count)
Lines 111-117 Link Here
111	break;	114	break;
112	}	115	}
113		116
114	ppos += start < page ? (long)start : n; / Move down the file */	117	pos = start < page ? (long)start : n; /* Move down the file */
		118	*ppos = pos;
115	nbytes -= n;	119	nbytes -= n;
116	buf += n;	120	buf += n;
117	retval += n;	121	retval += n;

Lines 93-100 Link Here

(-)linux-2.4.21/fs/proc/kcore.c (-1 / +2 lines)
93	if (copy_to_user(buf, (void *) (PAGE_OFFSET+p-PAGE_SIZE), count))	93	if (copy_to_user(buf, (void *) (PAGE_OFFSET+p-PAGE_SIZE), count))
94	return -EFAULT;	94	return -EFAULT;
95	read += count;	95	read += count;
		96	p += count;
96	}	97	}
97	*ppos += read;	98	*ppos = p;
98	return read;	99	return read;
99	}	100	}
100	#else /* CONFIG_KCORE_AOUT */	101	#else /* CONFIG_KCORE_AOUT */




static ssize_t read_profile(struct file *file, char *buf,
			    size_t count, loff_t *ppos)
{
	loff_t n = *ppos;
	unsigned p = n;
	ssize_t read;
	char * pnt;
	unsigned int sample_step = 1 << prof_shift;

	if (p != n || p >= (prof_len+1)*sizeof(unsigned int))
		return 0;
	if (count > (prof_len+1)*sizeof(unsigned int) - p)
		count = (prof_len+1)*sizeof(unsigned int) - p;

	if (copy_to_user(buf,(void *)pnt,count))
		return -EFAULT;
	read += count;
	*ppos = n + read;
	return read;
}


Lines 155-161 Link Here

(-)linux-2.4.21/fs/udf/file.c (-3 / +7 lines)
155	{	155	{
156	ssize_t retval;	156	ssize_t retval;
157	struct inode *inode = file->f_dentry->d_inode;	157	struct inode *inode = file->f_dentry->d_inode;
158	int err, pos;	158	int err;
		159	loff_t pos;
159		160
160	if (UDF_I_ALLOCTYPE(inode) == ICBTAG_FLAG_AD_IN_ICB)	161	if (UDF_I_ALLOCTYPE(inode) == ICBTAG_FLAG_AD_IN_ICB)
161	{	162	{
Lines 164-171 Link Here
164	else	165	else
165	pos = *ppos;	166	pos = *ppos;
166		167
167	if (inode->i_sb->s_blocksize < (udf_file_entry_alloc_offset(inode) +	168	if (pos < 0 \|\| pos + count < pos)
168	pos + count))	169	return 0;
		170
		171	if (inode->i_sb->s_blocksize - udf_file_entry_alloc_offset(inode) <
		172	pos + count)
169	{	173	{
170	udf_expand_file_adinicb(inode, pos + count, &err);	174	udf_expand_file_adinicb(inode, pos + count, &err);
171	if (UDF_I_ALLOCTYPE(inode) == ICBTAG_FLAG_AD_IN_ICB)	175	if (UDF_I_ALLOCTYPE(inode) == ICBTAG_FLAG_AD_IN_ICB)

Lines 1101-1110 Link Here

(-)linux-2.4.21/mm/shmem.c (-2 / +6 lines)
1101	struct inode *inode = filp->f_dentry->d_inode;	1101	struct inode *inode = filp->f_dentry->d_inode;
1102	struct address_space *mapping = inode->i_mapping;	1102	struct address_space *mapping = inode->i_mapping;
1103	unsigned long index, offset;	1103	unsigned long index, offset;
		1104	loff_t pos = *ppos;
1104	int nr = 1;	1105	int nr = 1;
1105		1106
1106	index = *ppos >> PAGE_CACHE_SHIFT;	1107	if (unlikel(pos < 0))
1107	offset = *ppos & ~PAGE_CACHE_MASK;	1108	return;
		1109
		1110	index = pos >> PAGE_CACHE_SHIFT;
		1111	offset = pos & ~PAGE_CACHE_MASK;
1108		1112
1109	while (nr && desc->count) {	1113	while (nr && desc->count) {
1110	struct page *page;	1114	struct page *page;




	struct inode *inode = file->f_dentry->d_inode;
	struct proc_dir_entry *dent;
	char *page;
	int pos, len;
	loff_t n = *ppos;
	unsigned offs = pos;

	if (count <= 0)
		return 0;

		return -ENOBUFS;

	pos = dent->get_info(page, dent->data, 0, 0);
	if (offs = n && offs < pos) {
	if (offs < pos) {
		len = min_t(int, pos - offs, count);
		if (copy_to_user(buf, (page + offs), len)) {
			kfree(page);
			return -EFAULT;
		}

		*ppos = offs + len;
	} else {
		len = 0;
	}




	unsigned long page;
	int len = 0, x, left;
	page = get_free_page(GFP_KERNEL);
	loff_t n = *pos;
	if (!page)
		return -ENOMEM;
	left = PAGE_SIZE - 256;

		left = count;
	read_lock(&devs_lock);
	for (;;) {
		x = br2684_proc_engine(n, &((char *) page)[len]);
		if (x == 0)
			break;
		if (x > left)

		}
		len += x;
		left -= x;
		n++;
		if (left < 256)
			break;
	}
	read_unlock(&devs_lock);
	*pos = n;
	if (len > 0 && copy_to_user(buf, (char *) page, len))
		len = -EFAULT;
	free_page(page);




	eg_cache_entry *eg_entry;
	struct timeval now;
	unsigned char ip_string[16];
	loff_t n = *pos;
	if(count == 0)
	        return 0;
	page = get_free_page(GFP_KERNEL);

		mpc = mpc->next;
	}

	if (n != (unsigned)n || n >= length) length = 0;
	else {
	  if (count > length - n) count = length - n;
	  if (copy_to_user(buff, (char *)page , count)) {
 		  free_page(page);
		  return -EFAULT;
          }
	  *pos = n + count;
	}

 	free_page(page);




		struct inode *inode = file->f_dentry->d_inode;
		struct proc_dir_entry* dent;
		char* page;
		int pos, len;
		loff_t n = *ppos;
		unsigned offs = n;

		if (count <= 0)
			return 0;

			return -ENOBUFS;
			
		pos = dent->get_info(page, dent->data, 0, 0);
		if (offs == n && offs < pos) {
		if (offs < pos) {
			len = min_t(unsigned int, pos - offs, count);
			if (copy_to_user(buf, (page + offs), len)) {
				kfree(page);
				return -EFAULT;
			}
			*ppos = offs + len;
		}
		else
			len = 0;

Return to bug 56074

Lines 1648-1658 Link Here

(-)linux-2.4.21/arch/i386/kernel/mtrr.c (-5 / +10 lines)
1648	static ssize_t mtrr_read (struct file file, char buf, size_t len,	1648	static ssize_t mtrr_read (struct file file, char buf, size_t len,
1649	loff_t *ppos)	1649	loff_t *ppos)
1650	{	1650	{
1651	if (*ppos >= ascii_buf_bytes) return 0;	1651	loff_t pos = *ppos;
1652	if (ppos + len > ascii_buf_bytes) len = ascii_buf_bytes - ppos;	1652	if (pos < 0 \|\| pos >= ascii_buf_bytes)
1653	if ( copy_to_user (buf, ascii_buffer + *ppos, len) ) return -EFAULT;	1653	return 0;
1654	*ppos += len;	1654	if (len > ascii_buf_bytes - pos)
1655	return len;	1655	len = ascii_buf_bytes - pos;
		1656	if (copy_to_user(buf, ascii_buffer + pos, len))
		1657	return -EFAULT;
		1658	pos += len;
		1659	*ppos = pos;
		1660	return len;
1656	} /* End Function mtrr_read */	1661	} /* End Function mtrr_read */
1657		1662
1658	static ssize_t mtrr_write (struct file file, const char buf, size_t len,	1663	static ssize_t mtrr_write (struct file file, const char buf, size_t len,

Lines 470-476 Link Here

(-)linux-2.4.21/arch/s390/kernel/debug.c (-3 / +3 lines)
470	goto out;	470	goto out;
471	}	471	}
472	out:	472	out:
473	p_info->offset = *offset + count;	473	p_info->offset += count;
474	p_info->act_entry_offset = size;	474	p_info->act_entry_offset = size;
475	*offset = p_info->offset;	475	*offset = p_info->offset;
476	return count;	476	return count;
Lines 1068-1074 Link Here
1068	input_buf[0]);	1068	input_buf[0]);
1069	}	1069	}
1070	out:	1070	out:
1071	*offset += in_buf_size;	1071	*offset = in_buf_size;
1072	return rc; /* number of input characters */	1072	return rc; /* number of input characters */
1073	}	1073	}
1074		1074
Lines 1135-1141 Link Here
1135	printk(KERN_INFO "debug: area `%c` is not valid\n", input_buf[0]);	1135	printk(KERN_INFO "debug: area `%c` is not valid\n", input_buf[0]);
1136		1136
1137	out:	1137	out:
1138	*offset += in_buf_size;	1138	*offset = in_buf_size;
1139	return rc; /* number of input characters */	1139	return rc; /* number of input characters */
1140	}	1140	}
1141		1141

Lines 470-476 Link Here

(-)linux-2.4.21/arch/s390x/kernel/debug.c (-3 / +3 lines)
470	goto out;	470	goto out;
471	}	471	}
472	out:	472	out:
473	p_info->offset = *offset + count;	473	p_info->offset += count;
474	p_info->act_entry_offset = size;	474	p_info->act_entry_offset = size;
475	*offset = p_info->offset;	475	*offset = p_info->offset;
476	return count;	476	return count;
Lines 1068-1074 Link Here
1068	input_buf[0]);	1068	input_buf[0]);
1069	}	1069	}
1070	out:	1070	out:
1071	*offset += in_buf_size;	1071	*offset = in_buf_size;
1072	return rc; /* number of input characters */	1072	return rc; /* number of input characters */
1073	}	1073	}
1074		1074
Lines 1135-1141 Link Here
1135	printk(KERN_INFO "debug: area `%c` is not valid\n", input_buf[0]);	1135	printk(KERN_INFO "debug: area `%c` is not valid\n", input_buf[0]);
1136		1136
1137	out:	1137	out:
1138	*offset += in_buf_size;	1138	*offset = in_buf_size;
1139	return rc; /* number of input characters */	1139	return rc; /* number of input characters */
1140	}	1140	}
1141		1141

Lines 957-972 Link Here

(-)linux-2.4.21/arch/x86_64/kernel/mtrr.c (-5 / +8 lines)
957	static ssize_t mtrr_read (struct file file, char buf, size_t len,	957	static ssize_t mtrr_read (struct file file, char buf, size_t len,
958	loff_t * ppos)	958	loff_t * ppos)
959	{	959	{
960	if (*ppos >= ascii_buf_bytes)	960	loff_t n = *ppos;
		961	unsigned pos = n;
		962
		963	if (pos != n \|\| pos >= ascii_buf_bytes)
961	return 0;	964	return 0;
962		965
963	if (*ppos + len > ascii_buf_bytes)	966	if (len > ascii_buf_bytes - pos)
964	len = ascii_buf_bytes - *ppos;	967	len = ascii_buf_bytes - pos;
965		968
966	if (copy_to_user (buf, ascii_buffer + *ppos, len))	969	if (copy_to_user (buf, ascii_buffer + pos, len))
967	return -EFAULT;	970	return -EFAULT;
968		971
969	*ppos += len;	972	*ppos = pos + len;
970	return len;	973	return len;
971	}	974	}
972		975

Lines 4854-4859 Link Here

(-)linux-2.4.21/drivers/char/istallion.c (-10 / +14 lines)
4854	void *memptr;	4854	void *memptr;
4855	stlibrd_t *brdp;	4855	stlibrd_t *brdp;
4856	int brdnr, size, n;	4856	int brdnr, size, n;
		4857	loff_t pos = *offp;
4857		4858
4858	#if DEBUG	4859	#if DEBUG
4859	printk(KERN_DEBUG "stli_memread(fp=%x,buf=%x,count=%x,offp=%x)\n",	4860	printk(KERN_DEBUG "stli_memread(fp=%x,buf=%x,count=%x,offp=%x)\n",
Lines 4868-4892 Link Here
4868	return(-ENODEV);	4869	return(-ENODEV);
4869	if (brdp->state == 0)	4870	if (brdp->state == 0)
4870	return(-ENODEV);	4871	return(-ENODEV);
4871	if (fp->f_pos >= brdp->memsize)	4872	if (pos != (unsigned)pos \|\| pos >= brdp->memsize)
4872	return(0);	4873	return(0);
4873		4874
4874	size = MIN(count, (brdp->memsize - fp->f_pos));	4875	size = MIN(count, (brdp->memsize - pos));
4875		4876
4876	save_flags(flags);	4877	save_flags(flags);
4877	cli();	4878	cli();
4878	EBRDENABLE(brdp);	4879	EBRDENABLE(brdp);
4879	while (size > 0) {	4880	while (size > 0) {
4880	memptr = (void *) EBRDGETMEMPTR(brdp, fp->f_pos);	4881	memptr = (void *) EBRDGETMEMPTR(brdp, pos);
4881	n = MIN(size, (brdp->pagesize - (((unsigned long) fp->f_pos) % brdp->pagesize)));	4882	n = MIN(size, (brdp->pagesize - (((unsigned long) pos) % brdp->pagesize)));
4882	if (copy_to_user(buf, memptr, n)) {	4883	if (copy_to_user(buf, memptr, n)) {
4883	count = -EFAULT;	4884	count = -EFAULT;
4884	goto out;	4885	goto out;
4885	}	4886	}
4886	fp->f_pos += n;	4887	pos += n;
4887	buf += n;	4888	buf += n;
4888	size -= n;	4889	size -= n;
4889	}	4890	}
		4891	*offp = pos;
4890	out:	4892	out:
4891	EBRDDISABLE(brdp);	4893	EBRDDISABLE(brdp);
4892	restore_flags(flags);	4894	restore_flags(flags);
Lines 4909-4914 Link Here
4909	stlibrd_t *brdp;	4911	stlibrd_t *brdp;
4910	char *chbuf;	4912	char *chbuf;
4911	int brdnr, size, n;	4913	int brdnr, size, n;
		4914	loff_t pos = *offp;
4912		4915
4913	#if DEBUG	4916	#if DEBUG
4914	printk(KERN_DEBUG "stli_memwrite(fp=%x,buf=%x,count=%x,offp=%x)\n",	4917	printk(KERN_DEBUG "stli_memwrite(fp=%x,buf=%x,count=%x,offp=%x)\n",
Lines 4923-4948 Link Here
4923	return(-ENODEV);	4926	return(-ENODEV);
4924	if (brdp->state == 0)	4927	if (brdp->state == 0)
4925	return(-ENODEV);	4928	return(-ENODEV);
4926	if (fp->f_pos >= brdp->memsize)	4929	if (pos != (unsigned)pos \|\| pos >= brdp->memsize)
4927	return(0);	4930	return(0);
4928		4931
4929	chbuf = (char *) buf;	4932	chbuf = (char *) buf;
4930	size = MIN(count, (brdp->memsize - fp->f_pos));	4933	size = MIN(count, (brdp->memsize - pos));
4931		4934
4932	save_flags(flags);	4935	save_flags(flags);
4933	cli();	4936	cli();
4934	EBRDENABLE(brdp);	4937	EBRDENABLE(brdp);
4935	while (size > 0) {	4938	while (size > 0) {
4936	memptr = (void *) EBRDGETMEMPTR(brdp, fp->f_pos);	4939	memptr = (void *) EBRDGETMEMPTR(brdp, pos);
4937	n = MIN(size, (brdp->pagesize - (((unsigned long) fp->f_pos) % brdp->pagesize)));	4940	n = MIN(size, (brdp->pagesize - (((unsigned long) pos) % brdp->pagesize)));
4938	if (copy_from_user(memptr, chbuf, n)) {	4941	if (copy_from_user(memptr, chbuf, n)) {
4939	count = -EFAULT;	4942	count = -EFAULT;
4940	goto out;	4943	goto out;
4941	}	4944	}
4942	fp->f_pos += n;	4945	pos += n;
4943	chbuf += n;	4946	chbuf += n;
4944	size -= n;	4947	size -= n;
4945	}	4948	}
		4949	*offp = pos;
4946	out:	4950	out:
4947	EBRDDISABLE(brdp);	4951	EBRDDISABLE(brdp);
4948	restore_flags(flags);	4952	restore_flags(flags);

Lines 494-500 Link Here

(-)linux-2.4.21/arch/cris/drivers/eeprom.c (-6 / +6 lines)
494	static ssize_t eeprom_read(struct file * file, char * buf, size_t count, loff_t *off)	494	static ssize_t eeprom_read(struct file * file, char * buf, size_t count, loff_t *off)
495	{	495	{
496	int i, read=0;	496	int i, read=0;
497	unsigned long p = file->f_pos;	497	unsigned long p = *off;
498		498
499	unsigned char page;	499	unsigned char page;
500		500
Lines 528-534 Link Here
528	return -EFAULT;	528	return -EFAULT;
529	}	529	}
530		530
531	if( (p + count) > eeprom.size)	531	if (count > eeprom.size - p)
532	{	532	{
533	/* truncate count */	533	/* truncate count */
534	count = eeprom.size - p;	534	count = eeprom.size - p;
Lines 548-554 Link Here
548		548
549	if(read > 0)	549	if(read > 0)
550	{	550	{
551	file->f_pos += read;	551	*off = p + read;
552	}	552	}
553		553
554	eeprom.busy--;	554	eeprom.busy--;
Lines 593-599 Link Here
593	{	593	{
594	restart = 0;	594	restart = 0;
595	written = 0;	595	written = 0;
596	p = file->f_pos;	596	p = *off;
597		597
598		598
599	while( (written < count) && (p < eeprom.size))	599	while( (written < count) && (p < eeprom.size))
Lines 721-730 Link Here
721		721
722	eeprom.busy--;	722	eeprom.busy--;
723	wake_up_interruptible(&eeprom.wait_q);	723	wake_up_interruptible(&eeprom.wait_q);
724	if (written == 0 && file->f_pos >= eeprom.size){	724	if (written == 0 && p >= eeprom.size){
725	return -ENOSPC;	725	return -ENOSPC;
726	}	726	}
727	file->f_pos += written;	727	*off = p;
728	return written;	728	return written;
729	}	729	}
730		730

Lines 352-357 Link Here

(-)linux-2.4.21/arch/ia64/kernel/efivars.c (-4 / +5 lines)
352	efi_sys_table_read(struct file file, char buffer, size_t count, loff_t *ppos)	352	efi_sys_table_read(struct file file, char buffer, size_t count, loff_t *ppos)
353	{	353	{
354	void *data;	354	void *data;
		355	loff_t pos = *ppos;
355		356
356	ssize_t size;	357	ssize_t size;
357	int max_nr_entries = 7; /* num ptrs to tables we could expose */	358	int max_nr_entries = 7; /* num ptrs to tables we could expose */
Lines 381-398 Link Here
381	if( efi.boot_info > 0 )	382	if( efi.boot_info > 0 )
382	length += sprintf(proc_buffer+length, "BootInfo=0x%lx\n", __pa(efi.boot_info));	383	length += sprintf(proc_buffer+length, "BootInfo=0x%lx\n", __pa(efi.boot_info));
383		384
384	if( *ppos >= length )	385	if (pos != (unsigned)pos \|\| pos >= length)
385	return 0;	386	return 0;
386		387
387	data = (u8 *) proc_buffer + file->f_pos;	388	data = (u8 *) proc_buffer + pos;
388	size = length - file->f_pos;	389	size = length - pos;
389	if (size > count)	390	if (size > count)
390	size = count;	391	size = count;
391	if (copy_to_user(buffer, data, size))	392	if (copy_to_user(buffer, data, size))
392	return -EFAULT;	393	return -EFAULT;
393		394
394	kfree(proc_buffer);	395	kfree(proc_buffer);
395	*ppos += size;	396	*ppos = pos + size;
396	return size;	397	return size;
397	}	398	}
398		399

Lines 475-480 Link Here

(-)linux-2.4.21/arch/ia64/kernel/salinfo.c (-4 / +5 lines)
475	size_t size;	475	size_t size;
476	u8 *buf;	476	u8 *buf;
477	u64 bufsize;	477	u64 bufsize;
		478	loff_t pos = *ppos;
478		479
479	if (data->state == STATE_LOG_RECORD) {	480	if (data->state == STATE_LOG_RECORD) {
480	buf = data->log_buffer;	481	buf = data->log_buffer;
Lines 486-502 Link Here
486	buf = NULL;	487	buf = NULL;
487	bufsize = 0;	488	bufsize = 0;
488	}	489	}
489	if (*ppos >= bufsize)	490	if (pos != (unsigned)pos \|\| pos >= bufsize)
490	return 0;	491	return 0;
491		492
492	saldata = buf + file->f_pos;	493	saldata = buf + pos;
493	size = bufsize - file->f_pos;	494	size = bufsize - pos;
494	if (size > count)	495	if (size > count)
495	size = count;	496	size = count;
496	if (copy_to_user(buffer, saldata, size))	497	if (copy_to_user(buffer, saldata, size))
497	return -EFAULT;	498	return -EFAULT;
498		499
499	*ppos += size;	500	*ppos = pos + size;
500	return size;	501	return size;
501	}	502	}
502		503

Lines 112-117 Link Here

(-)linux-2.4.21/arch/ppc/kernel/ppc_htab.c (-5 / +6 lines)
112	size_t count, loff_t *ppos)	112	size_t count, loff_t *ppos)
113	{	113	{
114	unsigned long mmcr0 = 0, pmc1 = 0, pmc2 = 0;	114	unsigned long mmcr0 = 0, pmc1 = 0, pmc2 = 0;
		115	loff_t pos = *ppos;
115	int n = 0;	116	int n = 0;
116	#ifdef CONFIG_PPC_STD_MMU	117	#ifdef CONFIG_PPC_STD_MMU
117	int valid;	118	int valid;
Lines 213-226 Link Here
213	"Non-error misses: %lu\n"	214	"Non-error misses: %lu\n"
214	"Error misses\t: %lu\n",	215	"Error misses\t: %lu\n",
215	pte_misses, pte_errors);	216	pte_misses, pte_errors);
216	if (*ppos >= strlen(buffer))	217	if (pos != (unsigned)pos \|\| pos >= strlen(buffer))
217	return 0;	218	return 0;
218	if (n > strlen(buffer) - *ppos)	219	if (n > strlen(buffer) - pos)
219	n = strlen(buffer) - *ppos;	220	n = strlen(buffer) - pos;
220	if (n > count)	221	if (n > count)
221	n = count;	222	n = count;
222	copy_to_user(buf, buffer + *ppos, n);	223	copy_to_user(buf, buffer + pos, n);
223	*ppos += n;	224	*ppos = pos + n;
224	return n;	225	return n;
225	}	226	}
226		227

Lines 261-278 Link Here

(-)linux-2.4.21/arch/ppc/platforms/proc_rtas.c (-24 / +28 lines)
261	size_t count, loff_t *ppos)	261	size_t count, loff_t *ppos)
262	{	262	{
263	int n;	263	int n;
		264	loff_t pos = *ppos;
264	if (power_on_time == 0)	265	if (power_on_time == 0)
265	n = sprintf(buf, "Power on time not set\n");	266	n = sprintf(buf, "Power on time not set\n");
266	else	267	else
267	n = sprintf(buf, "%lu\n", power_on_time);	268	n = sprintf(buf, "%lu\n", power_on_time);
268		269
269	if (*ppos >= strlen(buf))	270	if (pos != (unsigned)pos \|\| pos >= strlen(buf))
270	return 0;	271	return 0;
271	if (n > strlen(buf) - *ppos)	272	if (n > strlen(buf) - pos)
272	n = strlen(buf) - *ppos;	273	n = strlen(buf) - pos;
273	if (n > count)	274	if (n > count)
274	n = count;	275	n = count;
275	*ppos += n;	276	*ppos = pos + n;
276	return n;	277	return n;
277	}	278	}
278		279
Lines 298-312 Link Here
298	size_t count, loff_t *ppos)	299	size_t count, loff_t *ppos)
299	{	300	{
300	int n = 0;	301	int n = 0;
		302	loff_t pos = *ppos;
301	if (progress_led != NULL)	303	if (progress_led != NULL)
302	n = sprintf (buf, "%s\n", progress_led);	304	n = sprintf (buf, "%s\n", progress_led);
303	if (*ppos >= strlen(buf))	305	if (pos != (unsigned)pos \|\| pos >= strlen(buf))
304	return 0;	306	return 0;
305	if (n > strlen(buf) - *ppos)	307	if (n > strlen(buf) - pos)
306	n = strlen(buf) - *ppos;	308	n = strlen(buf) - pos;
307	if (n > count)	309	if (n > count)
308	n = count;	310	n = count;
309	*ppos += n;	311	*ppos = pos + n;
310	return n;	312	return n;
311	}	313	}
312		314
Lines 342-347 Link Here
342	{	344	{
343	unsigned int year, mon, day, hour, min, sec;	345	unsigned int year, mon, day, hour, min, sec;
344	unsigned long ret = kmalloc(48, GFP_KERNEL);	346	unsigned long ret = kmalloc(48, GFP_KERNEL);
		347	loff_t pos = *ppos;
345	int n, error;	348	int n, error;
346		349
347	error = call_rtas("get-time-of-day", 0, 8, ret);	350	error = call_rtas("get-time-of-day", 0, 8, ret);
Lines 358-370 Link Here
358	}	361	}
359	kfree(ret);	362	kfree(ret);
360		363
361	if (*ppos >= strlen(buf))	364	if (pos != (unsigned)pos \|\| pos >= strlen(buf))
362	return 0;	365	return 0;
363	if (n > strlen(buf) - *ppos)	366	if (n > strlen(buf) - pos)
364	n = strlen(buf) - *ppos;	367	n = strlen(buf) - pos;
365	if (n > count)	368	if (n > count)
366	n = count;	369	n = count;
367	*ppos += n;	370	*ppos = pos + n;
368	return n;	371	return n;
369	}	372	}
370		373
Lines 729-744 Link Here
729	static ssize_t ppc_rtas_tone_freq_read(struct file * file, char * buf,	732	static ssize_t ppc_rtas_tone_freq_read(struct file * file, char * buf,
730	size_t count, loff_t *ppos)	733	size_t count, loff_t *ppos)
731	{	734	{
732	int n;	735	int n = sprintf(buf, "%lu\n", rtas_tone_frequency);
733	n = sprintf(buf, "%lu\n", rtas_tone_frequency);	736	loff_t pos = *ppos;
734		737
735	if (*ppos >= strlen(buf))	738	if (pos != (unsigned)pos \|\| pos >= strlen(buf))
736	return 0;	739	return 0;
737	if (n > strlen(buf) - *ppos)	740	if (n > strlen(buf) - pos)
738	n = strlen(buf) - *ppos;	741	n = strlen(buf) - pos;
739	if (n > count)	742	if (n > count)
740	n = count;	743	n = count;
741	*ppos += n;	744	*ppos = pos + n;
742	return n;	745	return n;
743	}	746	}
744	/* ****************************************************************** */	747	/* ****************************************************************** */
Lines 770-784 Link Here
770	static ssize_t ppc_rtas_tone_volume_read(struct file * file, char * buf,	773	static ssize_t ppc_rtas_tone_volume_read(struct file * file, char * buf,
771	size_t count, loff_t *ppos)	774	size_t count, loff_t *ppos)
772	{	775	{
773	int n;	776	int n = sprintf(buf, "%lu\n", rtas_tone_volume);
774	n = sprintf(buf, "%lu\n", rtas_tone_volume);	777	loff_t pos = *ppos;
775		778
776	if (*ppos >= strlen(buf))	779	if (pos != (unsigned)pos \|\| pos >= strlen(buf))
777	return 0;	780	return 0;
778	if (n > strlen(buf) - *ppos)	781	if (n > strlen(buf) - pos)
779	n = strlen(buf) - *ppos;	782	n = strlen(buf) - pos;
780	if (n > count)	783	if (n > count)
781	n = count;	784	n = count;
782	*ppos += n;	785	*ppos = pos + n;
		786
783	return n;	787	return n;
784	}	788	}

Lines 75-84 Link Here

(-)linux-2.4.21/arch/ppc64/kernel/nvram.c (-4 / +8 lines)
75	{	75	{
76	ssize_t len;	76	ssize_t len;
77	char *tmp_buffer;	77	char *tmp_buffer;
		78	loff_t pos = *ppos;
78		79
79	if (verify_area(VERIFY_WRITE, buf, count))	80	if (verify_area(VERIFY_WRITE, buf, count))
80	return -EFAULT;	81	return -EFAULT;
81	if (*ppos >= rtas_nvram_size)	82	if ((unsigned)pos != pos \|\| pos >= rtas_nvram_size)
82	return 0;	83	return 0;
83	if (count > rtas_nvram_size)	84	if (count > rtas_nvram_size)
84	count = rtas_nvram_size;	85	count = rtas_nvram_size;
Lines 89-95 Link Here
89	return -ENOMEM;	90	return -ENOMEM;
90	}	91	}
91		92
92	len = read_nvram(tmp_buffer, count, ppos);	93	len = read_nvram(tmp_buffer, count, &pos);
93	if (len <= 0) {	94	if (len <= 0) {
94	kfree(tmp_buffer);	95	kfree(tmp_buffer);
95	return len;	96	return len;
Lines 101-106 Link Here
101	}	102	}
102		103
103	kfree(tmp_buffer);	104	kfree(tmp_buffer);
		105	*ppos = pos;
104	return len;	106	return len;
105		107
106	}	108	}
Lines 110-119 Link Here
110	{	112	{
111	ssize_t len;	113	ssize_t len;
112	char * tmp_buffer;	114	char * tmp_buffer;
		115	loff_t pos = *ppos;
113		116
114	if (verify_area(VERIFY_READ, buf, count))	117	if (verify_area(VERIFY_READ, buf, count))
115	return -EFAULT;	118	return -EFAULT;
116	if (*ppos >= rtas_nvram_size)	119	if (pos != (unsigned) pos \|\| pos >= rtas_nvram_size)
117	return 0;	120	return 0;
118	if (count > rtas_nvram_size)	121	if (count > rtas_nvram_size)
119	count = rtas_nvram_size;	122	count = rtas_nvram_size;
Lines 129-135 Link Here
129	return -EFAULT;	132	return -EFAULT;
130	}	133	}
131		134
132	len = write_nvram(tmp_buffer, count, ppos);	135	len = write_nvram(tmp_buffer, count, &pos);
		136	*ppos = pos;
133		137
134	kfree(tmp_buffer);	138	kfree(tmp_buffer);
135	return len;	139	return len;

Lines 445-452 Link Here

(-)linux-2.4.21/arch/ppc64/kernel/proc_pmc.c (-10 / +7 lines)
445	}	445	}
446	pnt = (char *)(perfmon_base.profile_buffer) + p - sizeof(unsigned int);	446	pnt = (char *)(perfmon_base.profile_buffer) + p - sizeof(unsigned int);
447	copy_to_user(buf,(void *)pnt,count);	447	copy_to_user(buf,(void *)pnt,count);
		448	p += count;
448	read += count;	449	read += count;
449	*ppos += read;	450	*ppos = p;
450	return read;	451	return read;
451	}	452	}
452		453
Lines 460-478 Link Here
460	size_t count, loff_t *ppos)	461	size_t count, loff_t *ppos)
461	{	462	{
462	unsigned long p = *ppos;	463	unsigned long p = *ppos;
463	ssize_t read;
464	char * pnt;	464	char * pnt;
465		465
466	if (p >= (perfmon_base.trace_length)) return 0;	466	if (p >= (perfmon_base.trace_length)) return 0;
467	if (count > (perfmon_base.trace_length) - p)	467	if (count > (perfmon_base.trace_length) - p)
468	count = (perfmon_base.trace_length) - p;	468	count = (perfmon_base.trace_length) - p;
469	read = 0;
470		469
471	pnt = (char *)(perfmon_base.trace_buffer) + p;	470	pnt = (char *)(perfmon_base.trace_buffer) + p;
472	copy_to_user(buf,(void *)pnt,count);	471	copy_to_user(buf,(void *)pnt,count);
473	read += count;	472	p += count;
474	*ppos += read;	473	*ppos = p;
475	return read;	474	return count;
476	}	475	}
477		476
478	static ssize_t write_trace(struct file * file, const char * buf,	477	static ssize_t write_trace(struct file * file, const char * buf,
Lines 492-504 Link Here
492	if (p >= (perfmon_base.timeslice_length)) return 0;	491	if (p >= (perfmon_base.timeslice_length)) return 0;
493	if (count > (perfmon_base.timeslice_length) - p)	492	if (count > (perfmon_base.timeslice_length) - p)
494	count = (perfmon_base.timeslice_length) - p;	493	count = (perfmon_base.timeslice_length) - p;
495	read = 0;
496		494
497	pnt = (char *)(perfmon_base.timeslice_buffer) + p;	495	pnt = (char *)(perfmon_base.timeslice_buffer) + p;
498	copy_to_user(buf,(void *)pnt,count);	496	copy_to_user(buf,(void *)pnt,count);
499	read += count;	497	*ppos = p + count;
500	*ppos += read;	498	return count;
501	return read;
502	}	499	}
503		500
504	static ssize_t write_timeslice(struct file * file, const char * buf,	501	static ssize_t write_timeslice(struct file * file, const char * buf,

Lines 225-230 Link Here

(-)linux-2.4.21/arch/ppc64/kernel/rtas_flash.c (-14 / +17 lines)
225	struct proc_dir_entry *dp = file->f_dentry->d_inode->u.generic_ip;	225	struct proc_dir_entry *dp = file->f_dentry->d_inode->u.generic_ip;
226	struct rtas_update_flash_t *uf;	226	struct rtas_update_flash_t *uf;
227	char msg[RTAS_MSG_MAXLEN];	227	char msg[RTAS_MSG_MAXLEN];
		228	loff_t pos = *ppos;
228	int msglen;	229	int msglen;
229	ssize_t ret;	230	ssize_t ret;
230		231
Lines 238-256 Link Here
238	msglen = sprintf(msg, "%d\n", uf->status);	239	msglen = sprintf(msg, "%d\n", uf->status);
239	}	240	}
240		241
241	if (*ppos >= msglen) {	242	if (pos != (unsigned)pos \|\| pos >= msglen) {
242	ret = 0;	243	ret = 0;
243	goto done;	244	goto done;
244	}	245	}
245	msglen -= *ppos;	246	msglen -= pos;
246	if (msglen > count)	247	if (msglen > count)
247	msglen = count;	248	msglen = count;
248		249
249	if (copy_to_user(buf, msg + (*ppos), msglen)) {	250	if (copy_to_user(buf, msg + pos, msglen)) {
250	ret = -EFAULT;	251	ret = -EFAULT;
251	goto done;	252	goto done;
252	}	253	}
253	*ppos += msglen;	254	*ppos = pos + msglen;
254	ret = msglen;	255	ret = msglen;
255	done:	256	done:
256	up(&rtas_flash_sem);	257	up(&rtas_flash_sem);
Lines 387-392 Link Here
387	char msg[RTAS_MSG_MAXLEN];	388	char msg[RTAS_MSG_MAXLEN];
388	int msglen;	389	int msglen;
389	ssize_t ret;	390	ssize_t ret;
		391	loff_t pos = *ppos;
390		392
391	if (down_interruptible(&rtas_flash_sem))	393	if (down_interruptible(&rtas_flash_sem))
392	return -ERESTARTSYS;	394	return -ERESTARTSYS;
Lines 397-416 Link Here
397	}	399	}
398		400
399	msglen = sprintf(msg, "%d\n", args_buf->status);	401	msglen = sprintf(msg, "%d\n", args_buf->status);
400	if (*ppos >= msglen) {	402	if (pos != (unsigned)pos \|\| pos >= msglen) {
401	ret = 0;	403	ret = 0;
402	goto done;	404	goto done;
403	}	405	}
404		406
405	msglen -= *ppos;	407	msglen -= pos;
406	if (msglen > count)	408	if (msglen > count)
407	msglen = count;	409	msglen = count;
408		410
409	if (copy_to_user(buf, msg + (*ppos), msglen)) {	411	if (copy_to_user(buf, msg + pos, msglen)) {
410	ret = -EFAULT;	412	ret = -EFAULT;
411	goto done;	413	goto done;
412	}	414	}
413	*ppos += msglen;	415	*ppos = pos + msglen;
414	ret = msglen;	416	ret = msglen;
415		417
416	done:	418	done:
Lines 553-558 Link Here
553	{	555	{
554	struct proc_dir_entry *dp = file->f_dentry->d_inode->u.generic_ip;	556	struct proc_dir_entry *dp = file->f_dentry->d_inode->u.generic_ip;
555	struct rtas_validate_flash_t *args_buf;	557	struct rtas_validate_flash_t *args_buf;
		558	loff_t pos = *off;
556	ssize_t ret;	559	ssize_t ret;
557		560
558	if (down_interruptible(&rtas_flash_sem))	561	if (down_interruptible(&rtas_flash_sem))
Lines 570-594 Link Here
570		573
571	/* We are only interested in the first 4K of the	574	/* We are only interested in the first 4K of the
572	* candidate image */	575	* candidate image */
573	if ((*off >= VALIDATE_BUF_SIZE) \|\|	576	if (pos != (unsigned)pos \|\| pos >= VALIDATE_BUF_SIZE \|\|
574	(args_buf->status == VALIDATE_AUTH)) {	577	(args_buf->status == VALIDATE_AUTH)) {
575	*off += count;	578	*off = pos + count;
576	ret = count;	579	ret = count;
577	goto done;	580	goto done;
578	}	581	}
579		582
580	if (*off + count >= VALIDATE_BUF_SIZE) {	583	if (count >= VALIDATE_BUF_SIZE - pos) {
581	count = VALIDATE_BUF_SIZE - *off;	584	count = VALIDATE_BUF_SIZE - pos;
582	args_buf->status = VALIDATE_READY;	585	args_buf->status = VALIDATE_READY;
583	} else {	586	} else {
584	args_buf->status = VALIDATE_INCOMPLETE;	587	args_buf->status = VALIDATE_INCOMPLETE;
585	}	588	}
586		589
587	if (copy_from_user(args_buf->buf + *off, buf, count)) {	590	if (copy_from_user(args_buf->buf + pos, buf, count)) {
588	ret = -EFAULT;	591	ret = -EFAULT;
589	goto done;	592	goto done;
590	}	593	}
591	*off += count;	594	*off = pos + count;
592	ret = count;	595	ret = count;
593		596
594	done:	597	done:

Lines 347-352 Link Here

(-)linux-2.4.21/arch/ppc64/kernel/rtas-proc.c (-34 / +35 lines)
347	size_t count, loff_t *ppos)	347	size_t count, loff_t *ppos)
348	{	348	{
349	char timebuf[40];	349	char timebuf[40];
		350	loff_t pos = *ppos;
350	int n;	351	int n;
351		352
352	if (power_on_time == 0)	353	if (power_on_time == 0)
Lines 354-370 Link Here
354	else	355	else
355	n = snprintf(timebuf, 40, "%lu\n", power_on_time);	356	n = snprintf(timebuf, 40, "%lu\n", power_on_time);
356		357
357	if (*ppos >= n)	358	if (pos != (unsigned)pos \|\| pos >= n)
358	return 0;	359	return 0;
359	n++; /* Include the null terminator */	360	n++; /* Include the null terminator */
360	if (*ppos)	361	n -= pos;
361	n -= *ppos;
362	if (n > count)	362	if (n > count)
363	n = count;	363	n = count;
364	if (copy_to_user (buf, timebuf + (*ppos), n)) {	364	if (copy_to_user (buf, timebuf + pos, n)) {
365	return -EFAULT;	365	return -EFAULT;
366	}	366	}
367	*ppos += n;	367	*ppos = pos + n;
368	return n;	368	return n;
369	}	369	}
370		370
Lines 395-400 Link Here
395	{	395	{
396	int n;	396	int n;
397	char * tmpbuf;	397	char * tmpbuf;
		398	loff_t pos = *ppos;
398		399
399	tmpbuf = kmalloc (MAX_LINELENGTH, GFP_KERNEL);	400	tmpbuf = kmalloc (MAX_LINELENGTH, GFP_KERNEL);
400	if (!tmpbuf) {	401	if (!tmpbuf) {
Lines 404-424 Link Here
404	n = snprintf (tmpbuf, MAX_LINELENGTH, "%s\n", progress_led);	405	n = snprintf (tmpbuf, MAX_LINELENGTH, "%s\n", progress_led);
405	if (n > MAX_LINELENGTH) n = MAX_LINELENGTH;	406	if (n > MAX_LINELENGTH) n = MAX_LINELENGTH;
406		407
407	if (*ppos >= n) {	408	if (pos != (unsigned)pos \|\| pos >= n) {
408	kfree (tmpbuf);	409	kfree (tmpbuf);
409	return 0;	410	return 0;
410	}	411	}
411	n++; /* Include the null terminator */	412	n++; /* Include the null terminator */
412	if (*ppos)	413	n -= pos;
413	n -= *ppos;
414	if (n > count)	414	if (n > count)
415	n = count;	415	n = count;
416	if (copy_to_user (buf, tmpbuf + (*ppos), n)) {	416	if (copy_to_user (buf, tmpbuf + pos, n)) {
417	kfree (tmpbuf);	417	kfree (tmpbuf);
418	return -EFAULT;	418	return -EFAULT;
419	}	419	}
420	kfree (tmpbuf);	420	kfree (tmpbuf);
421	*ppos += n;	421	*ppos = pos + n;
422	return n;	422	return n;
423	}	423	}
424		424
Lines 466-471 Link Here
466	unsigned long tod[8];	466	unsigned long tod[8];
467	int n, error;	467	int n, error;
468	char timebuf[30];	468	char timebuf[30];
		469	loff_t pos = *ppos;
469		470
470	error = rtas_call(rtas_token("get-time-of-day"), 0, 8, tod);	471	error = rtas_call(rtas_token("get-time-of-day"), 0, 8, tod);
471		472
Lines 482-498 Link Here
482	mktime(year, mon, day, hour, min, sec));	483	mktime(year, mon, day, hour, min, sec));
483	}	484	}
484		485
485	if (*ppos >= n)	486	if (pos != (unsigned)pos \|\| pos >= n)
486	return 0;	487	return 0;
487	n++; /* Include the null terminator */	488	n++; /* Include the null terminator */
488	if (*ppos)	489	n -= pos;
489	n -= *ppos;
490	if (n > count)	490	if (n > count)
491	n = count;	491	n = count;
492	if (copy_to_user (buf, timebuf + (*ppos), n)) {	492	if (copy_to_user (buf, timebuf + pos, n)) {
493	return -EFAULT;	493	return -EFAULT;
494	}	494	}
495	*ppos += n;	495	*ppos = pos + n;
496	return n;	496	return n;
497	}	497	}
498		498
Lines 873-891 Link Here
873	{	873	{
874	int n;	874	int n;
875	char freqbuf[30];	875	char freqbuf[30];
		876	loff_t pos = *ppos;
876		877
877	n = snprintf(freqbuf, 30, "%lu\n", rtas_tone_frequency);	878	n = snprintf(freqbuf, 30, "%lu\n", rtas_tone_frequency);
878	if (*ppos >= n)	879	if (pos != (unsigned)pos \|\| pos >= n)
879	return 0;	880	return 0;
880	n++; /* Include the null terminator */	881	n++; /* Include the null terminator */
881	if (*ppos)	882	n -= pos;
882	n -= *ppos;
883	if (n > count)	883	if (n > count)
884	n = count;	884	n = count;
885	if (copy_to_user (buf, freqbuf + (*ppos), n)) {	885	if (copy_to_user (buf, freqbuf + pos, n)) {
886	return -EFAULT;	886	return -EFAULT;
887	}	887	}
888	*ppos += n;	888	*ppos = pos + n;
889	return n;	889	return n;
890	}	890	}
891	/* ****************************************************************** */	891	/* ****************************************************************** */
Lines 931-949 Link Here
931	{	931	{
932	int n;	932	int n;
933	char volbuf[10];	933	char volbuf[10];
		934	loff_t pos = *ppos;
934		935
935	n = snprintf(volbuf, 10, "%lu\n", rtas_tone_volume);	936	n = snprintf(volbuf, 10, "%lu\n", rtas_tone_volume);
936	if (*ppos >= n)	937	if (pos != (unsigned)pos \|\| pos >= n)
937	return 0;	938	return 0;
938	n++; /* Include the null terminator */	939	n++; /* Include the null terminator */
939	if (*ppos)	940	n -= pos;
940	n -= *ppos;
941	if (n > count)	941	if (n > count)
942	n = count;	942	n = count;
943	if (copy_to_user (buf, volbuf + (*ppos), n)) {	943	if (copy_to_user (buf, volbuf + pos, n)) {
944	return -EFAULT;	944	return -EFAULT;
945	}	945	}
946	*ppos += n;	946	*ppos = pos + n;
947	return n;	947	return n;
948	}	948	}
949		949
Lines 1047-1052 Link Here
1047	int i;	1047	int i;
1048	int n = 0, cnt;	1048	int n = 0, cnt;
1049	int m = MAX_ERRINJCT_TOKENS * (ERRINJCT_TOKEN_LEN+1);	1049	int m = MAX_ERRINJCT_TOKENS * (ERRINJCT_TOKEN_LEN+1);
		1050	loff_t pos = *ppos;
1050		1051
1051	buffer = (char *)kmalloc(m, GFP_KERNEL);	1052	buffer = (char *)kmalloc(m, GFP_KERNEL);
1052	if (!buffer) {	1053	if (!buffer) {
Lines 1064-1084 Link Here
1064	n += cnt;	1065	n += cnt;
1065	}	1066	}
1066		1067
1067	if (*ppos >= n) {	1068	if (pos != (unsigned)pos \|\| pos >= n) {
1068	kfree(buffer);	1069	kfree(buffer);
1069	return 0;	1070	return 0;
1070	}	1071	}
1071	n++; /* Include the null terminator */	1072	n++; /* Include the null terminator */
1072	if (*ppos)	1073	n -= pos;
1073	n -= *ppos;
1074	if (n > count)	1074	if (n > count)
1075	n = count;	1075	n = count;
1076	if (copy_to_user(buf, buffer + *ppos, n)) {	1076	if (copy_to_user(buf, buffer + pos, n)) {
1077	kfree (buffer);	1077	kfree (buffer);
1078	return -EFAULT;	1078	return -EFAULT;
1079	}	1079	}
1080		1080
1081	*ppos += n;	1081	*ppos = pos + n;
1082		1082
1083	kfree(buffer);	1083	kfree(buffer);
1084	return n;	1084	return n;
Lines 1091-1107 Link Here
1091	size_t count, loff_t *ppos)	1091	size_t count, loff_t *ppos)
1092	{	1092	{
1093	char kbuf[RMO_READ_BUF_MAX];	1093	char kbuf[RMO_READ_BUF_MAX];
		1094	loff_t pos = *ppos;
1094	int n;	1095	int n;
1095		1096
1096	n = sprintf(kbuf, "%016lx %x\n", rtas_rmo_buf, RTAS_RMOBUF_MAX);	1097	n = sprintf(kbuf, "%016lx %x\n", rtas_rmo_buf, RTAS_RMOBUF_MAX);
1097		1098
1098	if (*ppos >= n)	1099	if (pos != (unsigned)pos \|\| pos >= n)
1099	return 0;	1100	return 0;
1100	n -= *ppos;	1101	n -= pos;
1101	if (n > count)	1102	if (n > count)
1102	n = count;	1103	n = count;
1103	if (copy_to_user(buf, kbuf + *ppos, n))	1104	if (copy_to_user(buf, kbuf + pos, n))
1104	return -EFAULT;	1105	return -EFAULT;
1105	*ppos += n;	1106	*ppos = pos + n;
1106	return n;	1107	return n;
1107	}	1108	}

Lines 367-372 Link Here

(-)linux-2.4.21/drivers/block/acsi_slm.c (-6 / +7 lines)
367		367
368	{	368	{
369	struct inode *node = file->f_dentry->d_inode;	369	struct inode *node = file->f_dentry->d_inode;
		370	loff_t pos = *ppos;
370	unsigned long page;	371	unsigned long page;
371	int length;	372	int length;
372	int end;	373	int end;
Lines 381-398 Link Here
381	count = length;	382	count = length;
382	goto out;	383	goto out;
383	}	384	}
384	if (file->f_pos >= length) {	385	if (pos != (unsigned)pos \|\| pos >= length) {
385	count = 0;	386	count = 0;
386	goto out;	387	goto out;
387	}	388	}
388	if (count + file->f_pos > length)	389	if (count > length - pos)
389	count = length - file->f_pos;	390	count = length - pos;
390	end = count + file->f_pos;	391	end = count + pos;
391	if (copy_to_user(buf, (char *)page + file->f_pos, count)) {	392	if (copy_to_user(buf, (char *)page + pos, count)) {
392	count = -EFAULT;	393	count = -EFAULT;
393	goto out;	394	goto out;
394	}	395	}
395	file->f_pos = end;	396	*ppos = end;
396	out: free_page( page );	397	out: free_page( page );
397	return( count );	398	return( count );
398	}	399	}

Lines 493-498 Link Here

(-)linux-2.4.21/drivers/char/i8k.c (-4 / +5 lines)
493		493
494	static ssize_t i8k_read(struct file f, char buffer, size_t len, loff_t *fpos)	494	static ssize_t i8k_read(struct file f, char buffer, size_t len, loff_t *fpos)
495	{	495	{
		496	loff_t pos = *fpos;
496	int n;	497	int n;
497	char info[128];	498	char info[128];
498		499
Lines 501-519 Link Here
501	return n;	502	return n;
502	}	503	}
503		504
504	if (*fpos >= n) {	505	if (pos != (unsigned)pos \|\| pos >= n) {
505	return 0;	506	return 0;
506	}	507	}
507		508
508	if ((*fpos + len) >= n) {	509	if (len >= n - pos) {
509	len = n - *fpos;	510	len = n - pos;
510	}	511	}
511		512
512	if (copy_to_user(buffer, info, len) != 0) {	513	if (copy_to_user(buffer, info, len) != 0) {
513	return -EFAULT;	514	return -EFAULT;
514	}	515	}
515		516
516	*fpos += len;	517	*fpos = pos + len;
517	return len;	518	return len;
518	}	519	}
519		520

Lines 133-139 Link Here

(-)linux-2.4.21/drivers/char/nwflash.c (-6 / +8 lines)
133		133
134	static ssize_t flash_read(struct file file, char buf, size_t size, loff_t * ppos)	134	static ssize_t flash_read(struct file file, char buf, size_t size, loff_t * ppos)
135	{	135	{
136	unsigned long p = *ppos;	136	loff_t n = *ppos;
		137	unsigned long p = n;
137	unsigned int count = size;	138	unsigned int count = size;
138	int ret = 0;	139	int ret = 0;
139		140
Lines 144-150 Link Here
144	if (count)	145	if (count)
145	ret = -ENXIO;	146	ret = -ENXIO;
146		147
147	if (p < gbFlashSize) {	148	if (n == p && p < gbFlashSize) {
148	if (count > gbFlashSize - p)	149	if (count > gbFlashSize - p)
149	count = gbFlashSize - p;	150	count = gbFlashSize - p;
150		151
Lines 155-161 Link Here
155	return -ERESTARTSYS;	156	return -ERESTARTSYS;
156		157
157	ret = count - copy_to_user(buf, (void *)(FLASH_BASE + p), count);	158	ret = count - copy_to_user(buf, (void *)(FLASH_BASE + p), count);
158	*ppos += ret;	159	*ppos = p + ret;
159	up(&nwflash_sem);	160	up(&nwflash_sem);
160	if (ret == 0)	161	if (ret == 0)
161	ret = -EFAULT;	162	ret = -EFAULT;
Lines 165-171 Link Here
165		166
166	static ssize_t flash_write(struct file file, const char buf, size_t size, loff_t * ppos)	167	static ssize_t flash_write(struct file file, const char buf, size_t size, loff_t * ppos)
167	{	168	{
168	unsigned long p = *ppos;	169	loff_t n = *ppos;
		170	unsigned long p = n;
169	unsigned int count = size;	171	unsigned int count = size;
170	int written;	172	int written;
171	int nBlock, temp, rc;	173	int nBlock, temp, rc;
Lines 184-190 Link Here
184	/*	186	/*
185	* check for out of range pos or count	187	* check for out of range pos or count
186	*/	188	*/
187	if (p >= gbFlashSize)	189	if (p != n \|\| p >= gbFlashSize)
188	return count ? -ENXIO : 0;	190	return count ? -ENXIO : 0;
189		191
190	if (count > gbFlashSize - p)	192	if (count > gbFlashSize - p)
Lines 273-279 Link Here
273	p += rc;	275	p += rc;
274	buf += rc;	276	buf += rc;
275	written += rc;	277	written += rc;
276	*ppos += rc;	278	*ppos = p;
277		279
278	if (flashdebug)	280	if (flashdebug)
279	printk(KERN_DEBUG "flash_write: written 0x%X bytes OK.\n", written);	281	printk(KERN_DEBUG "flash_write: written 0x%X bytes OK.\n", written);

Lines 98-104 Link Here

(-)linux-2.4.21/drivers/char/vc_screen.c (-10 / +10 lines)
98	{	98	{
99	struct inode *inode = file->f_dentry->d_inode;	99	struct inode *inode = file->f_dentry->d_inode;
100	unsigned int currcons = MINOR(inode->i_rdev);	100	unsigned int currcons = MINOR(inode->i_rdev);
101	long pos = *ppos;	101	loff_t n = *ppos;
		102	unsigned pos = n;
102	long viewed, attr, read;	103	long viewed, attr, read;
103	int col, maxcol;	104	int col, maxcol;
104	unsigned short *org = NULL;	105	unsigned short *org = NULL;
Lines 124-134 Link Here
124	if (!vc_cons_allocated(currcons))	125	if (!vc_cons_allocated(currcons))
125	goto unlock_out;	126	goto unlock_out;
126		127
127	ret = -EINVAL;
128	if (pos < 0)
129	goto unlock_out;
130	read = 0;	128	read = 0;
131	ret = 0;	129	ret = 0;
		130	if (pos != n)
		131	goto unlock_out;
132	while (count) {	132	while (count) {
133	char con_buf0, con_buf_start;	133	char con_buf0, con_buf_start;
134	long this_round, size;	134	long this_round, size;
Lines 244-259 Link Here
244	acquire_console_sem();	244	acquire_console_sem();
245		245
246	if (ret) {	246	if (ret) {
247	read += (orig_count - ret);
248	ret = -EFAULT;	247	ret = -EFAULT;
249	break;	248	goto unlock_out;
250	}	249	}
251	buf += orig_count;	250	buf += orig_count;
252	pos += orig_count;	251	pos += orig_count;
253	read += orig_count;	252	read += orig_count;
254	count -= orig_count;	253	count -= orig_count;
255	}	254	}
256	*ppos += read;	255	*ppos = pos;
257	if (read)	256	if (read)
258	ret = read;	257	ret = read;
259	unlock_out:	258	unlock_out:
Lines 267-273 Link Here
267	{	266	{
268	struct inode *inode = file->f_dentry->d_inode;	267	struct inode *inode = file->f_dentry->d_inode;
269	unsigned int currcons = MINOR(inode->i_rdev);	268	unsigned int currcons = MINOR(inode->i_rdev);
270	long pos = *ppos;	269	loff_t n = *ppos;
		270	unsigned pos = n;
271	long viewed, attr, size, written;	271	long viewed, attr, size, written;
272	char *con_buf0;	272	char *con_buf0;
273	int col, maxcol;	273	int col, maxcol;
Lines 297-303 Link Here
297		297
298	size = vcs_size(inode);	298	size = vcs_size(inode);
299	ret = -EINVAL;	299	ret = -EINVAL;
300	if (pos < 0 \|\| pos > size)	300	if (pos != n \|\| pos > size)
301	goto unlock_out;	301	goto unlock_out;
302	if (count > size - pos)	302	if (count > size - pos)
303	count = size - pos;	303	count = size - pos;
Lines 435-441 Link Here
435	if (org0)	435	if (org0)
436	update_region(currcons, (unsigned long)(org0), org-org0);	436	update_region(currcons, (unsigned long)(org0), org-org0);
437	}	437	}
438	*ppos += written;	438	*ppos = pos;
439	ret = written;	439	ret = written;
440		440
441	unlock_out:	441	unlock_out:

Lines 604-610 Link Here

(-)linux-2.4.21/drivers/hotplug/pci_hotplug_core.c (-18 / +22 lines)
604	retval = -EFAULT;	604	retval = -EFAULT;
605	goto exit;	605	goto exit;
606	}	606	}
607	*offset += len;	607	*offset = len;
608	retval = len;	608	retval = len;
609		609
610	exit:	610	exit:
Lines 715-721 Link Here
715	retval = -EFAULT;	715	retval = -EFAULT;
716	goto exit;	716	goto exit;
717	}	717	}
718	*offset += len;	718	*offset = len;
719	retval = len;	719	retval = len;
720		720
721	exit:	721	exit:
Lines 780-793 Link Here
780	int retval;	780	int retval;
781	int len;	781	int len;
782	u8 value;	782	u8 value;
		783	loff_t off = *offset;
783		784
784	dbg("count = %d, offset = %lld\n", count, *offset);	785	dbg("count = %d, offset = %lld\n", count, off);
785		786
786	if (*offset < 0)	787	if (off < 0)
787	return -EINVAL;	788	return -EINVAL;
788	if (count <= 0)	789	if (count <= 0)
789	return 0;	790	return 0;
790	if (*offset != 0)	791	if (off != 0)
791	return 0;	792	return 0;
792		793
793	if (slot == NULL) {	794	if (slot == NULL) {
Lines 808-814 Link Here
808	retval = -EFAULT;	809	retval = -EFAULT;
809	goto exit;	810	goto exit;
810	}	811	}
811	*offset += len;	812	*offset = off + len;
812	retval = len;	813	retval = len;
813		814
814	exit:	815	exit:
Lines 823-836 Link Here
823	int retval;	824	int retval;
824	int len;	825	int len;
825	u8 value;	826	u8 value;
		827	loff_t off = *offset;
826		828
827	dbg("count = %d, offset = %lld\n", count, *offset);	829	dbg("count = %d, offset = %lld\n", count, off);
828		830
829	if (*offset < 0)	831	if (off < 0)
830	return -EINVAL;	832	return -EINVAL;
831	if (count <= 0)	833	if (count <= 0)
832	return 0;	834	return 0;
833	if (*offset != 0)	835	if (off != 0)
834	return 0;	836	return 0;
835		837
836	if (slot == NULL) {	838	if (slot == NULL) {
Lines 851-857 Link Here
851	retval = -EFAULT;	853	retval = -EFAULT;
852	goto exit;	854	goto exit;
853	}	855	}
854	*offset += len;	856	*offset = off + len;
855	retval = len;	857	retval = len;
856		858
857	exit:	859	exit:
Lines 869-882 Link Here
869	int retval;	871	int retval;
870	int len = 0;	872	int len = 0;
871	enum pci_bus_speed value;	873	enum pci_bus_speed value;
		874	loff_t off = *offset;
872		875
873	dbg ("count = %d, offset = %lld\n", count, *offset);	876	dbg ("count = %d, offset = %lld\n", count, off);
874		877
875	if (*offset < 0)	878	if (off < 0)
876	return -EINVAL;	879	return -EINVAL;
877	if (count <= 0)	880	if (count <= 0)
878	return 0;	881	return 0;
879	if (*offset != 0)	882	if (off != 0)
880	return 0;	883	return 0;
881		884
882	if (slot == NULL) {	885	if (slot == NULL) {
Lines 903-909 Link Here
903	retval = -EFAULT;	906	retval = -EFAULT;
904	goto exit;	907	goto exit;
905	}	908	}
906	*offset += len;	909	*offset = off + len;
907	retval = len;	910	retval = len;
908		911
909	exit:	912	exit:
Lines 919-932 Link Here
919	int retval;	922	int retval;
920	int len = 0;	923	int len = 0;
921	enum pci_bus_speed value;	924	enum pci_bus_speed value;
		925	loff_t off = *offset;
922		926
923	dbg ("count = %d, offset = %lld\n", count, *offset);	927	dbg ("count = %d, offset = %lld\n", count, off);
924		928
925	if (*offset < 0)	929	if (off < 0)
926	return -EINVAL;	930	return -EINVAL;
927	if (count <= 0)	931	if (count <= 0)
928	return 0;	932	return 0;
929	if (*offset != 0)	933	if (off != 0)
930	return 0;	934	return 0;
931		935
932	if (slot == NULL) {	936	if (slot == NULL) {
Lines 953-959 Link Here
953	retval = -EFAULT;	957	retval = -EFAULT;
954	goto exit;	958	goto exit;
955	}	959	}
956	*offset += len;	960	*offset = off + len;
957	retval = len;	961	retval = len;
958		962
959	exit:	963	exit:

Lines 1064-1075 Link Here

(-)linux-2.4.21/drivers/ieee1394/pcilynx.c (-16 / +24 lines)
1064	ssize_t retval;	1064	ssize_t retval;
1065	void *membase;	1065	void *membase;
1066		1066
1067	if ((off + count) > PCILYNX_MAX_MEMORY+1) {	1067	if (!count)
1068	count = PCILYNX_MAX_MEMORY+1 - off;	1068	return 0;
1069	}	1069	if (off < 0)
1070	if (count == 0 \|\| off > PCILYNX_MAX_MEMORY) {	1070	return -EINVAL;
		1071	if (off > PCILYNX_MAX_MEMORY)
1071	return -ENOSPC;	1072	return -ENOSPC;
1072	}	1073	if (count > PCILYNX_MAX_MEMORY + 1 - off)
		1074	count = PCILYNX_MAX_MEMORY + 1 - off;
1073		1075
1074	switch (md->type) {	1076	switch (md->type) {
1075	case rom:	1077	case rom:
Lines 1090-1095 Link Here
1090		1092
1091	if (count < mem_mindma) {	1093	if (count < mem_mindma) {
1092	memcpy_fromio(md->lynx->mem_dma_buffer, membase+off, count);	1094	memcpy_fromio(md->lynx->mem_dma_buffer, membase+off, count);
		1095	off += count;
1093	goto out;	1096	goto out;
1094	}	1097	}
1095		1098
Lines 1120-1125 Link Here
1120	if (bcount) {	1123	if (bcount) {
1121	memcpy_fromio(md->lynx->mem_dma_buffer + count - bcount,	1124	memcpy_fromio(md->lynx->mem_dma_buffer + count - bcount,
1122	membase+off, bcount);	1125	membase+off, bcount);
		1126	off += bcount;
1123	}	1127	}
1124		1128
1125	out:	1129	out:
Lines 1127-1133 Link Here
1127	up(&md->lynx->mem_dma_mutex);	1131	up(&md->lynx->mem_dma_mutex);
1128		1132
1129	if (retval < 0) return retval;	1133	if (retval < 0) return retval;
1130	*offset += count;	1134	*offset = off;
1131	return count;	1135	return count;
1132	}	1136	}
1133		1137
Lines 1136-1164 Link Here
1136	loff_t *offset)	1140	loff_t *offset)
1137	{	1141	{
1138	struct memdata md = (struct memdata )file->private_data;	1142	struct memdata md = (struct memdata )file->private_data;
		1143	loff_t off = *offset;
1139		1144
1140	if (((*offset) + count) > PCILYNX_MAX_MEMORY+1) {	1145	if (!count)
1141	count = PCILYNX_MAX_MEMORY+1 - *offset;	1146	return 0;
1142	}	1147	if (off < PCILYNX_MAX_MEMORY)
1143	if (count == 0 \|\| *offset > PCILYNX_MAX_MEMORY) {	1148	return -EINVAL;
1144	return -ENOSPC;	1149	if (off > PCILYNX_MAX_MEMORY)
1145	}	1150	return -ENOSPC;
		1151
		1152	if (count) > PCILYNX_MAX_MEMORY + 1 - off)
		1153	count = PCILYNX_MAX_MEMORY + 1 - off;
1146		1154
1147	/* FIXME: dereferencing pointers to PCI mem doesn't work everywhere */	1155	/* FIXME: dereferencing pointers to PCI mem doesn't work everywhere */
1148	switch (md->type) {	1156	switch (md->type) {
1149	case aux:	1157	case aux:
1150	copy_from_user(md->lynx->aux_port+(*offset), buffer, count);	1158	copy_from_user(md->lynx->aux_port+off, buffer, count);
1151	break;	1159	break;
1152	case ram:	1160	case ram:
1153	copy_from_user(md->lynx->local_ram+(*offset), buffer, count);	1161	copy_from_user(md->lynx->local_ram+off, buffer, count);
1154	break;	1162	break;
1155	case rom:	1163	case rom:
1156	/* the ROM may be writeable */	1164	/* the ROM may be writeable */
1157	copy_from_user(md->lynx->local_rom+(*offset), buffer, count);	1165	copy_from_user(md->lynx->local_rom+off, buffer, count);
1158	break;	1166	break;
1159	}	1167	}
1160		1168
1161	file->f_pos += count;	1169	*offset = off + count;
1162	return count;	1170	return count;
1163	}	1171	}
1164	#endif /* CONFIG_IEEE1394_PCILYNX_PORTS */	1172	#endif /* CONFIG_IEEE1394_PCILYNX_PORTS */

Lines 212-240 Link Here

(-)linux-2.4.21/drivers/isdn/hysdn/hysdn_procconf.c (-16 / +14 lines)
212	static ssize_t	212	static ssize_t
213	hysdn_conf_read(struct file file, char buf, size_t count, loff_t * off)	213	hysdn_conf_read(struct file file, char buf, size_t count, loff_t * off)
214	{	214	{
		215	loff_t pos = *off;
215	char *cp;	216	char *cp;
216	int i;	217	int i;
217		218
218	if (off != &file->f_pos) /* fs error check */	219	if (off != &file->f_pos) /* fs error check */
219	return -ESPIPE;	220	return -ESPIPE;
220		221
221	if (file->f_mode & FMODE_READ) {	222	if (!(cp = file->private_data))
222	if (!(cp = file->private_data))	223	return (-EFAULT); /* should never happen */
223	return (-EFAULT); /* should never happen */	224	i = strlen(cp); /* get total string length */
224	i = strlen(cp); /* get total string length */	225	if (pos == (unsigned)pos && pos < i) {
225	if (*off < i) {	226	/* still bytes to transfer */
226	/* still bytes to transfer */	227	cp += pos; /* point to desired data offset */
227	cp += off; / point to desired data offset */	228	i -= pos; /* remaining length */
228	i -= off; / remaining length */	229	if (i > count)
229	if (i > count)	230	i = count; /* limit length to transfer */
230	i = count; /* limit length to transfer */	231	if (copy_to_user(buf, cp, i))
231	if (copy_to_user(buf, cp, i))	232	return (-EFAULT); /* copy error */
232	return (-EFAULT); /* copy error */	233	off = pos + i; / adjust offset */
233	off += i; / adjust offset */
234	} else
235	return (0);
236	} else	234	} else
237	return (-EPERM); /* no permission to read */	235	return (0);
238		236
239	return (i);	237	return (i);
240	} /* hysdn_conf_read */	238	} /* hysdn_conf_read */

Lines 61-73 Link Here

(-)linux-2.4.21/drivers/macintosh/ans-lcd.c (-4 / +4 lines)
61		61
62	if ( verify_area(VERIFY_READ, buf, count) )	62	if ( verify_area(VERIFY_READ, buf, count) )
63	return -EFAULT;	63	return -EFAULT;
64	for ( i = *ppos; count > 0; ++i, ++p, --count )	64	while (count--) {
65	{
66	char c;	65	char c;
67	__get_user(c, p);	66	if (__get_user(c, p++))
		67	return -EFAULT;
68	anslcd_write_byte_data( c );	68	anslcd_write_byte_data( c );
69	}	69	}
70	*ppos = i;	70	*ppos += p - buf;
71	return p - buf;	71	return p - buf;
72	}	72	}
73		73

Lines 37-50 Link Here

(-)linux-2.4.21/drivers/macintosh/nvram.c (-6 / +8 lines)
37	static ssize_t read_nvram(struct file file, char buf,	37	static ssize_t read_nvram(struct file file, char buf,
38	size_t count, loff_t *ppos)	38	size_t count, loff_t *ppos)
39	{	39	{
40	unsigned int i;	40	loff_t n = *ppos;
		41	unsigned int i = n;
41	char *p = buf;	42	char *p = buf;
42		43
43	if (verify_area(VERIFY_WRITE, buf, count))	44	if (verify_area(VERIFY_WRITE, buf, count))
44	return -EFAULT;	45	return -EFAULT;
45	if (*ppos >= NVRAM_SIZE)	46	if (i != n \|\| i >= NVRAM_SIZE)
46	return 0;	47	return 0;
47	for (i = *ppos; count > 0 && i < NVRAM_SIZE; ++i, ++p, --count)	48	for (; count > 0 && i < NVRAM_SIZE; ++i, ++p, --count)
48	if (__put_user(nvram_read_byte(i), p))	49	if (__put_user(nvram_read_byte(i), p))
49	return -EFAULT;	50	return -EFAULT;
50	*ppos = i;	51	*ppos = i;
Lines 54-68 Link Here
54	static ssize_t write_nvram(struct file file, const char buf,	55	static ssize_t write_nvram(struct file file, const char buf,
55	size_t count, loff_t *ppos)	56	size_t count, loff_t *ppos)
56	{	57	{
57	unsigned int i;	58	loff_t n = *ppos;
		59	unsigned int i = n;
58	const char *p = buf;	60	const char *p = buf;
59	char c;	61	char c;
60		62
61	if (verify_area(VERIFY_READ, buf, count))	63	if (verify_area(VERIFY_READ, buf, count))
62	return -EFAULT;	64	return -EFAULT;
63	if (*ppos >= NVRAM_SIZE)	65	if (i != n \|\| i >= NVRAM_SIZE)
64	return 0;	66	return 0;
65	for (i = *ppos; count > 0 && i < NVRAM_SIZE; ++i, ++p, --count) {	67	for (; count > 0 && i < NVRAM_SIZE; ++i, ++p, --count) {
66	if (__get_user(c, p))	68	if (__get_user(c, p))
67	return -EFAULT;	69	return -EFAULT;
68	nvram_write_byte(c, i);	70	nvram_write_byte(c, i);

Lines 55-74 Link Here

(-)linux-2.4.21/drivers/oprofile/oprofilefs.c (-10 / +14 lines)
55	ssize_t oprofilefs_str_to_user(char const * str, char * buf, size_t count, loff_t * offset)	55	ssize_t oprofilefs_str_to_user(char const * str, char * buf, size_t count, loff_t * offset)
56	{	56	{
57	size_t len = strlen(str);	57	size_t len = strlen(str);
		58	loff_t n = *offset;
		59	unsigned pos = n;
58		60
59	if (!count)	61	if (!count)
60	return 0;	62	return 0;
61		63
62	if (*offset > len)	64	if (pos != n \|\| pos > len)
63	return 0;	65	return 0;
64		66
65	if (count > len - *offset)	67	if (count > len - pos)
66	count = len - *offset;	68	count = len - pos;
67		69
68	if (copy_to_user(buf, str + *offset, count))	70	if (copy_to_user(buf, str + pos, count))
69	return -EFAULT;	71	return -EFAULT;
70		72
71	*offset += count;	73	*offset = pos + count;
72		74
73	return count;	75	return count;
74	}	76	}
Lines 80-101 Link Here
80	{	82	{
81	char tmpbuf[TMPBUFSIZE];	83	char tmpbuf[TMPBUFSIZE];
82	size_t maxlen;	84	size_t maxlen;
		85	loff_t n = *offset;
		86	unsigned pos = n;
83		87
84	if (!count)	88	if (!count)
85	return 0;	89	return 0;
86		90
87	maxlen = snprintf(tmpbuf, TMPBUFSIZE, "%lu\n", *val);	91	maxlen = snprintf(tmpbuf, TMPBUFSIZE, "%lu\n", *val);
88		92
89	if (*offset > maxlen)	93	if (pos !=n \|\| pos > maxlen)
90	return 0;	94	return 0;
91		95
92	if (count > maxlen - *offset)	96	if (count > maxlen - pos)
93	count = maxlen - *offset;	97	count = maxlen - pos;
94		98
95	if (copy_to_user(buf, tmpbuf + *offset, count))	99	if (copy_to_user(buf, tmpbuf + pos, count))
96	return -EFAULT;	100	return -EFAULT;
97		101
98	*offset += count;	102	*offset = pos + count;
99		103
100	return count;	104	return count;
101	}	105	}

Lines 47-53 Link Here

(-)linux-2.4.21/drivers/pci/proc.c (-7 / +7 lines)
47	const struct inode *ino = file->f_dentry->d_inode;	47	const struct inode *ino = file->f_dentry->d_inode;
48	const struct proc_dir_entry *dp = ino->u.generic_ip;	48	const struct proc_dir_entry *dp = ino->u.generic_ip;
49	struct pci_dev *dev = dp->data;	49	struct pci_dev *dev = dp->data;
50	unsigned int pos = *ppos;	50	loff_t n = *ppos;
		51	unsigned pos = n;
51	unsigned int cnt, size;	52	unsigned int cnt, size;
52		53
53	/*	54	/*
Lines 63-69 Link Here
63	else	64	else
64	size = 64;	65	size = 64;
65		66
66	if (pos >= size)	67	if (pos != n \|\| pos >= size)
67	return 0;	68	return 0;
68	if (nbytes >= size)	69	if (nbytes >= size)
69	nbytes = size;	70	nbytes = size;
Lines 129-142 Link Here
129	const struct inode *ino = file->f_dentry->d_inode;	130	const struct inode *ino = file->f_dentry->d_inode;
130	const struct proc_dir_entry *dp = ino->u.generic_ip;	131	const struct proc_dir_entry *dp = ino->u.generic_ip;
131	struct pci_dev *dev = dp->data;	132	struct pci_dev *dev = dp->data;
132	int pos = *ppos;	133	loff_t n = *ppos;
		134	unsigned pos = n;
133	int cnt;	135	int cnt;
134		136
135	if (pos >= PCI_CFG_SPACE_SIZE)	137	if (pos != n \|\| pos >= PCI_CFG_SPACE_SIZE)
136	return 0;	138	return 0;
137	if (nbytes >= PCI_CFG_SPACE_SIZE)	139	if (nbytes > PCI_CFG_SPACE_SIZE - pos)
138	nbytes = PCI_CFG_SPACE_SIZE;
139	if (pos + nbytes > PCI_CFG_SPACE_SIZE)
140	nbytes = PCI_CFG_SPACE_SIZE - pos;	140	nbytes = PCI_CFG_SPACE_SIZE - pos;
141	cnt = nbytes;	141	cnt = nbytes;
142		142

Lines 102-107 Link Here

(-)linux-2.4.21/drivers/pnp/isapnp_proc.c (-16 / +17 lines)
102	size_t count, loff_t * offset)	102	size_t count, loff_t * offset)
103	{	103	{
104	isapnp_info_buffer_t *buf;	104	isapnp_info_buffer_t *buf;
		105	loff_t pos = *offset;
105	long size = 0, size1;	106	long size = 0, size1;
106	int mode;	107	int mode;
107		108
Lines 111-125 Link Here
111	buf = (isapnp_info_buffer_t *) file->private_data;	112	buf = (isapnp_info_buffer_t *) file->private_data;
112	if (!buf)	113	if (!buf)
113	return -EIO;	114	return -EIO;
114	if (file->f_pos >= buf->size)	115	if (pos != (unsigned)pos \|\| pos >= buf->size)
115	return 0;	116	return 0;
116	size = buf->size < count ? buf->size : count;	117	size = buf->size < count ? buf->size : count;
117	size1 = buf->size - file->f_pos;	118	size1 = buf->size - pos;
118	if (size1 < size)	119	if (size1 < size)
119	size = size1;	120	size = size1;
120	if (copy_to_user(buffer, buf->buffer + file->f_pos, size))	121	if (copy_to_user(buffer, buf->buffer + pos, size))
121	return -EFAULT;	122	return -EFAULT;
122	file->f_pos += size;	123	*offset = pos + size;
123	return size;	124	return size;
124	}	125	}
125		126
Lines 128-133 Link Here
128	{	129	{
129	isapnp_info_buffer_t *buf;	130	isapnp_info_buffer_t *buf;
130	long size = 0, size1;	131	long size = 0, size1;
		132	loff_t pos = *offset;
131	int mode;	133	int mode;
132		134
133	mode = file->f_flags & O_ACCMODE;	135	mode = file->f_flags & O_ACCMODE;
Lines 136-154 Link Here
136	buf = (isapnp_info_buffer_t *) file->private_data;	138	buf = (isapnp_info_buffer_t *) file->private_data;
137	if (!buf)	139	if (!buf)
138	return -EIO;	140	return -EIO;
139	if (file->f_pos < 0)	141	if (pos < 0)
140	return -EINVAL;	142	return -EINVAL;
141	if (file->f_pos >= buf->len)	143	if (pos >= buf->len)
142	return -ENOMEM;	144	return -ENOMEM;
143	size = buf->len < count ? buf->len : count;	145	size = buf->len < count ? buf->len : count;
144	size1 = buf->len - file->f_pos;	146	size1 = buf->len - pos;
145	if (size1 < size)	147	if (size1 < size)
146	size = size1;	148	size = size1;
147	if (copy_from_user(buf->buffer + file->f_pos, buffer, size))	149	if (copy_from_user(buf->buffer + pos, buffer, size))
148	return -EFAULT;	150	return -EFAULT;
149	if (buf->size < file->f_pos + size)	151	if (buf->size < pos + size)
150	buf->size = file->f_pos + size;	152	buf->size = pos + size;
151	file->f_pos += size;	153	*offset = pos + size;
152	return size;	154	return size;
153	}	155	}
154		156
Lines 240-253 Link Here
240	struct inode *ino = file->f_dentry->d_inode;	242	struct inode *ino = file->f_dentry->d_inode;
241	struct proc_dir_entry *dp = ino->u.generic_ip;	243	struct proc_dir_entry *dp = ino->u.generic_ip;
242	struct pci_dev *dev = dp->data;	244	struct pci_dev *dev = dp->data;
243	int pos = *ppos;	245	loff_t n = *ppos;
		246	unsigned pos = n;
244	int cnt, size = 256;	247	int cnt, size = 256;
245		248
246	if (pos >= size)	249	if (pos != n \|\| pos >= size)
247	return 0;	250	return 0;
248	if (nbytes >= size)	251	if (nbytes > size - pos)
249	nbytes = size;
250	if (pos + nbytes > size)
251	nbytes = size - pos;	252	nbytes = size - pos;
252	cnt = nbytes;	253	cnt = nbytes;
253		254

Lines 4670-4684 Link Here

(-)linux-2.4.21/drivers/s390/block/dasd.c (-4 / +6 lines)
4670	loff_t * offset)	4670	loff_t * offset)
4671	{	4671	{
4672	loff_t len;	4672	loff_t len;
		4673	loff_t n = *offset;
		4674	unsigned pos = n;
4673	tempinfo_t p_info = (tempinfo_t ) file->private_data;	4675	tempinfo_t p_info = (tempinfo_t ) file->private_data;
4674		4676
4675	if (*offset >= p_info->len) {	4677	if (n != pos \|\| pos >= p_info->len) {
4676	return 0; /* EOF */	4678	return 0; /* EOF */
4677	} else {	4679	} else {
4678	len = MIN (user_len, (p_info->len - *offset));	4680	len = MIN (user_len, (p_info->len - pos));
4679	if (copy_to_user (user_buf, &(p_info->data[*offset]), len))	4681	if (copy_to_user (user_buf, &(p_info->data[pos]), len))
4680	return -EFAULT;	4682	return -EFAULT;
4681	(*offset) += len;	4683	*offset = pos + len;
4682	return len; /* number of bytes "read" */	4684	return len; /* number of bytes "read" */
4683	}	4685	}
4684	}	4686	}

Lines 2899-2904 Link Here

(-)linux-2.4.21/drivers/s390/net/ctcmain.c (-8 / +12 lines)
2899	file->private_data = kmalloc(CTRL_BUFSIZE, GFP_KERNEL);	2899	file->private_data = kmalloc(CTRL_BUFSIZE, GFP_KERNEL);
2900	if (file->private_data == NULL)	2900	if (file->private_data == NULL)
2901	return -ENOMEM;	2901	return -ENOMEM;
		2902	(char )file->private_data = '\0';
2902	MOD_INC_USE_COUNT;	2903	MOD_INC_USE_COUNT;
2903	return 0;	2904	return 0;
2904	}	2905	}
Lines 2964-2969 Link Here
2964	ctc_priv *privptr;	2965	ctc_priv *privptr;
2965	ssize_t ret = 0;	2966	ssize_t ret = 0;
2966	char *p = sbuf;	2967	char *p = sbuf;
		2968	loff_t pos = *off;
2967	int l;	2969	int l;
2968		2970
2969	if (!(dev = find_netdev_by_ino(ino)))	2971	if (!(dev = find_netdev_by_ino(ino)))
Lines 2973-2991 Link Here
2973		2975
2974	privptr = (ctc_priv *)dev->priv;	2976	privptr = (ctc_priv *)dev->priv;
2975		2977
2976	if (file->f_pos == 0)	2978	if (!*sbuf \|\| pos == 0)
2977	sprintf(sbuf, "%d\n", privptr->channel[READ]->max_bufsize);	2979	sprintf(sbuf, "%d\n", privptr->channel[READ]->max_bufsize);
2978		2980
2979	l = strlen(sbuf);	2981	l = strlen(sbuf);
2980	p = sbuf;	2982	p = sbuf;
2981	if (file->f_pos < l) {	2983	if (pos == (unsigned)pos && pos < l) {
2982	p += file->f_pos;	2984	p += pos;
2983	l = strlen(p);	2985	l = strlen(p);
2984	ret = (count > l) ? l : count;	2986	ret = (count > l) ? l : count;
2985	if (copy_to_user(buf, p, ret))	2987	if (copy_to_user(buf, p, ret))
2986	return -EFAULT;	2988	return -EFAULT;
		2989	*off = pos + ret;
2987	}	2990	}
2988	file->f_pos += ret;
2989	return ret;	2991	return ret;
2990	}	2992	}
2991		2993
Lines 2996-3001 Link Here
2996	file->private_data = kmalloc(STATS_BUFSIZE, GFP_KERNEL);	2998	file->private_data = kmalloc(STATS_BUFSIZE, GFP_KERNEL);
2997	if (file->private_data == NULL)	2999	if (file->private_data == NULL)
2998	return -ENOMEM;	3000	return -ENOMEM;
		3001	(char )file->private_data = '\0';
2999	MOD_INC_USE_COUNT;	3002	MOD_INC_USE_COUNT;
3000	return 0;	3003	return 0;
3001	}	3004	}
Lines 3035-3040 Link Here
3035	ctc_priv *privptr;	3038	ctc_priv *privptr;
3036	ssize_t ret = 0;	3039	ssize_t ret = 0;
3037	char *p = sbuf;	3040	char *p = sbuf;
		3041	loff_t pos = *off;
3038	int l;	3042	int l;
3039		3043
3040	if (!(dev = find_netdev_by_ino(ino)))	3044	if (!(dev = find_netdev_by_ino(ino)))
Lines 3044-3050 Link Here
3044		3048
3045	privptr = (ctc_priv *)dev->priv;	3049	privptr = (ctc_priv *)dev->priv;
3046		3050
3047	if (file->f_pos == 0) {	3051	if (!*sbuf \|\| pos == 0) {
3048	p += sprintf(p, "Device FSM state: %s\n",	3052	p += sprintf(p, "Device FSM state: %s\n",
3049	fsm_getstate_str(privptr->fsm));	3053	fsm_getstate_str(privptr->fsm));
3050	p += sprintf(p, "RX channel FSM state: %s\n",	3054	p += sprintf(p, "RX channel FSM state: %s\n",
Lines 3066-3079 Link Here
3066	}	3070	}
3067	l = strlen(sbuf);	3071	l = strlen(sbuf);
3068	p = sbuf;	3072	p = sbuf;
3069	if (file->f_pos < l) {	3073	if (pos == (unsigned)pos && pos < l) {
3070	p += file->f_pos;	3074	p += pos;
3071	l = strlen(p);	3075	l = strlen(p);
3072	ret = (count > l) ? l : count;	3076	ret = (count > l) ? l : count;
3073	if (copy_to_user(buf, p, ret))	3077	if (copy_to_user(buf, p, ret))
3074	return -EFAULT;	3078	return -EFAULT;
		3079	*off = pos + ret;
3075	}	3080	}
3076	file->f_pos += ret;
3077	return ret;	3081	return ret;
3078	}	3082	}
3079		3083

Lines 1366-1371 Link Here

(-)linux-2.4.21/drivers/s390/net/netiucv.c (-12 / +19 lines)
1366	file->private_data = kmalloc(CTRL_BUFSIZE, GFP_KERNEL);	1366	file->private_data = kmalloc(CTRL_BUFSIZE, GFP_KERNEL);
1367	if (file->private_data == NULL)	1367	if (file->private_data == NULL)
1368	return -ENOMEM;	1368	return -ENOMEM;
		1369	(char )file->private_data = '\0';
1369	MOD_INC_USE_COUNT;	1370	MOD_INC_USE_COUNT;
1370	return 0;	1371	return 0;
1371	}	1372	}
Lines 1431-1436 Link Here
1431	netiucv_priv *privptr;	1432	netiucv_priv *privptr;
1432	ssize_t ret = 0;	1433	ssize_t ret = 0;
1433	char *p = sbuf;	1434	char *p = sbuf;
		1435	loff_t pos = *ppos;
1434	int l;	1436	int l;
1435		1437
1436	if (!(dev = find_netdev_by_ino(ino)))	1438	if (!(dev = find_netdev_by_ino(ino)))
Lines 1440-1458 Link Here
1440		1442
1441	privptr = (netiucv_priv *)dev->priv;	1443	privptr = (netiucv_priv *)dev->priv;
1442		1444
1443	if (file->f_pos == 0)	1445	if (!*sbuf \|\| pos == 0)
1444	sprintf(sbuf, "%d\n", privptr->conn->max_buffsize);	1446	sprintf(sbuf, "%d\n", privptr->conn->max_buffsize);
1445		1447
1446	l = strlen(sbuf);	1448	l = strlen(sbuf);
1447	p = sbuf;	1449	p = sbuf;
1448	if (file->f_pos < l) {	1450	if (pos == (unsigned)pos && pos < l) {
1449	p += file->f_pos;	1451	p += pos;
1450	l = strlen(p);	1452	l = strlen(p);
1451	ret = (count > l) ? l : count;	1453	ret = (count > l) ? l : count;
1452	if (copy_to_user(buf, p, ret))	1454	if (copy_to_user(buf, p, ret))
1453	return -EFAULT;	1455	return -EFAULT;
1454	}	1456	}
1455	file->f_pos += ret;	1457	pos += ret;
		1458	*ppos = pos;
1456	return ret;	1459	return ret;
1457	}	1460	}
1458		1461
Lines 1462-1467 Link Here
1462	file->private_data = kmalloc(CTRL_BUFSIZE, GFP_KERNEL);	1465	file->private_data = kmalloc(CTRL_BUFSIZE, GFP_KERNEL);
1463	if (file->private_data == NULL)	1466	if (file->private_data == NULL)
1464	return -ENOMEM;	1467	return -ENOMEM;
		1468	(char )file->private_data = '\0';
1465	MOD_INC_USE_COUNT;	1469	MOD_INC_USE_COUNT;
1466	return 0;	1470	return 0;
1467	}	1471	}
Lines 1526-1531 Link Here
1526	netiucv_priv *privptr;	1530	netiucv_priv *privptr;
1527	ssize_t ret = 0;	1531	ssize_t ret = 0;
1528	char *p = sbuf;	1532	char *p = sbuf;
		1533	loff_t pos = *ppos;
1529	int l;	1534	int l;
1530		1535
1531	if (!(dev = find_netdev_by_ino(ino)))	1536	if (!(dev = find_netdev_by_ino(ino)))
Lines 1536-1555 Link Here
1536	privptr = (netiucv_priv *)dev->priv;	1541	privptr = (netiucv_priv *)dev->priv;
1537		1542
1538		1543
1539	if (file->f_pos == 0)	1544	if (!*sbuf \|\| pos == 0)
1540	sprintf(sbuf, "%s\n",	1545	sprintf(sbuf, "%s\n",
1541	netiucv_printname(privptr->conn->userid));	1546	netiucv_printname(privptr->conn->userid));
1542		1547
1543	l = strlen(sbuf);	1548	l = strlen(sbuf);
1544	p = sbuf;	1549	p = sbuf;
1545	if (file->f_pos < l) {	1550	if (pos == (unsigned)pos && pos < l) {
1546	p += file->f_pos;	1551	p += pos;
1547	l = strlen(p);	1552	l = strlen(p);
1548	ret = (count > l) ? l : count;	1553	ret = (count > l) ? l : count;
1549	if (copy_to_user(buf, p, ret))	1554	if (copy_to_user(buf, p, ret))
1550	return -EFAULT;	1555	return -EFAULT;
		1556	*ppos = pos + ret;
1551	}	1557	}
1552	file->f_pos += ret;
1553	return ret;	1558	return ret;
1554	}	1559	}
1555		1560
Lines 1561-1566 Link Here
1561	file->private_data = kmalloc(STATS_BUFSIZE, GFP_KERNEL);	1566	file->private_data = kmalloc(STATS_BUFSIZE, GFP_KERNEL);
1562	if (file->private_data == NULL)	1567	if (file->private_data == NULL)
1563	return -ENOMEM;	1568	return -ENOMEM;
		1569	(char )file->private_data = '\0';
1564	MOD_INC_USE_COUNT;	1570	MOD_INC_USE_COUNT;
1565	return 0;	1571	return 0;
1566	}	1572	}
Lines 1591-1596 Link Here
1591	netiucv_stat_read(struct file file, char buf, size_t count, loff_t *off)	1597	netiucv_stat_read(struct file file, char buf, size_t count, loff_t *off)
1592	{	1598	{
1593	unsigned int ino = ((struct inode *)file->f_dentry->d_inode)->i_ino;	1599	unsigned int ino = ((struct inode *)file->f_dentry->d_inode)->i_ino;
		1600	loff_t pos = *ppos;
1594	char sbuf = (char )file->private_data;	1601	char sbuf = (char )file->private_data;
1595	net_device *dev;	1602	net_device *dev;
1596	netiucv_priv *privptr;	1603	netiucv_priv *privptr;
Lines 1605-1611 Link Here
1605		1612
1606	privptr = (netiucv_priv *)dev->priv;	1613	privptr = (netiucv_priv *)dev->priv;
1607		1614
1608	if (file->f_pos == 0) {	1615	if (!*sbuf \|\| pos == 0) {
1609	p += sprintf(p, "Device FSM state: %s\n",	1616	p += sprintf(p, "Device FSM state: %s\n",
1610	fsm_getstate_str(privptr->fsm));	1617	fsm_getstate_str(privptr->fsm));
1611	p += sprintf(p, "Connection FSM state: %s\n",	1618	p += sprintf(p, "Connection FSM state: %s\n",
Lines 1629-1642 Link Here
1629	}	1636	}
1630	l = strlen(sbuf);	1637	l = strlen(sbuf);
1631	p = sbuf;	1638	p = sbuf;
1632	if (file->f_pos < l) {	1639	if (pos == (unsigned)pos && pos < l) {
1633	p += file->f_pos;	1640	p += pos;
1634	l = strlen(p);	1641	l = strlen(p);
1635	ret = (count > l) ? l : count;	1642	ret = (count > l) ? l : count;
1636	if (copy_to_user(buf, p, ret))	1643	if (copy_to_user(buf, p, ret))
1637	return -EFAULT;	1644	return -EFAULT;
		1645	*ppos = pos + ret;
1638	}	1646	}
1639	file->f_pos += ret;
1640	return ret;	1647	return ret;
1641	}	1648	}
1642		1649

Lines 5809-5814 Link Here

(-)linux-2.4.21/drivers/s390/scsi/zfcp.c (-26 / +31 lines)
5809		5809
5810	loff_t len;	5810	loff_t len;
5811	procbuf_t pbuf = (procbuf_t ) file->private_data;	5811	procbuf_t pbuf = (procbuf_t ) file->private_data;
		5812	loff_t pos = *offset;
5812		5813
5813	ZFCP_LOG_TRACE(	5814	ZFCP_LOG_TRACE(
5814	"enter (file=0x%lx user_buf=0x%lx "	5815	"enter (file=0x%lx user_buf=0x%lx "
Lines 5816-5835 Link Here
5816	(unsigned long)file,	5817	(unsigned long)file,
5817	(unsigned long)user_buf,	5818	(unsigned long)user_buf,
5818	user_len,	5819	user_len,
5819	(unsigned long)*offset);	5820	(unsigned long)pos);
5820		5821
5821	if ( *offset>=pbuf->len) {	5822	if (pos != (unsigned long)pos \|\| pos >= pbuf->len) {
5822	return 0;	5823	return 0;
5823	} else {	5824	} else {
5824	len = min(user_len, (unsigned long)(pbuf->len - *offset));	5825	len = min(user_len, (unsigned long)(pbuf->len - pos));
5825	if (copy_to_user( user_buf, &(pbuf->buf[*offset]), len))	5826	if (copy_to_user( user_buf, &(pbuf->buf[pos]), len))
5826	return -EFAULT;	5827	return -EFAULT;
5827	(* offset) += len;	5828	*offset = pos + len;
5828	return len;	5829	return len;
5829	}	5830	}
5830		5831
5831	ZFCP_LOG_TRACE("Size-offset is %ld, user_len is %ld\n ",	5832	ZFCP_LOG_TRACE("Size-offset is %ld, user_len is %ld\n ",
5832	((unsigned long)(pbuf->len - *offset)),	5833	((unsigned long)(pbuf->len - pos)),
5833	user_len);	5834	user_len);
5834		5835
5835	ZFCP_LOG_TRACE("exit (%Li)\n", len);	5836	ZFCP_LOG_TRACE("exit (%Li)\n", len);
Lines 6247-6252 Link Here
6247	zfcp_adapter_t *adapter=NULL;	6248	zfcp_adapter_t *adapter=NULL;
6248	zfcp_port_t *port=NULL;	6249	zfcp_port_t *port=NULL;
6249	zfcp_unit_t *unit=NULL;	6250	zfcp_unit_t *unit=NULL;
		6251	loff_t pos = *offset;
6250		6252
6251	/* Is used when we don't have a 0 offset, which cannot happen	6253	/* Is used when we don't have a 0 offset, which cannot happen
6252	* during the first call	6254	* during the first call
Lines 6259-6274 Link Here
6259	(unsigned long)file,	6261	(unsigned long)file,
6260	(unsigned long)user_buf,	6262	(unsigned long)user_buf,
6261	user_len,	6263	user_len,
6262	*offset);	6264	pos);
6263		6265
6264	/* Do not overwrite proc-buffer */	6266	/* Do not overwrite proc-buffer */
6265	user_len = min(user_len, ZFCP_MAX_PROC_SIZE);	6267	user_len = min(user_len, ZFCP_MAX_PROC_SIZE);
6266	size=0;	6268	size=0;
6267	if((*offset)==0) {	6269	if(pos==0) {
6268	current_unit=0;	6270	current_unit=0;
6269	line_offset=0;	6271	line_offset=0;
6270	} else {	6272	} else {
6271	current_unit = (*offset);	6273	current_unit = pos;
6272	line_offset = do_div(current_unit, item_size);	6274	line_offset = do_div(current_unit, item_size);
6273	ZFCP_LOG_TRACE("item_size %ld, current_unit %Ld, line_offset %Ld\n",	6275	ZFCP_LOG_TRACE("item_size %ld, current_unit %Ld, line_offset %Ld\n",
6274	item_size,	6276	item_size,
Lines 6322-6328 Link Here
6322	}	6324	}
6323		6325
6324	out:	6326	out:
6325	(*offset) += user_len;	6327	*offset = pos + user_len;
6326		6328
6327	ZFCP_LOG_TRACE("exit (%li)\n", user_len);	6329	ZFCP_LOG_TRACE("exit (%li)\n", user_len);
6328		6330
Lines 7051-7056 Link Here
7051		7053
7052	loff_t len;	7054	loff_t len;
7053	procbuf_t pbuf = (procbuf_t ) file->private_data;	7055	procbuf_t pbuf = (procbuf_t ) file->private_data;
		7056	loff_t pos = *offset;
7054		7057
7055	ZFCP_LOG_TRACE(	7058	ZFCP_LOG_TRACE(
7056	"enter (file=0x%lx user_buf=0x%lx "	7059	"enter (file=0x%lx user_buf=0x%lx "
Lines 7058-7072 Link Here
7058	(unsigned long)file,	7061	(unsigned long)file,
7059	(unsigned long)user_buf,	7062	(unsigned long)user_buf,
7060	user_len,	7063	user_len,
7061	(unsigned long)*offset);	7064	(unsigned long)pos);
7062		7065
7063	if ( *offset>=pbuf->len) {	7066	if ( pos != (unsigned long)pos \|\| pos >= pbuf->len) {
7064	return 0;	7067	return 0;
7065	} else {	7068	} else {
7066	len = min(user_len, (unsigned long)(pbuf->len - *offset));	7069	len = min(user_len, (unsigned long)(pbuf->len - pos));
7067	if (copy_to_user( user_buf, &(pbuf->buf[*offset]), len))	7070	if (copy_to_user( user_buf, &(pbuf->buf[pos]), len))
7068	return -EFAULT;	7071	return -EFAULT;
7069	(* offset) += len;	7072	*offset = pos + len;
7070	return len;	7073	return len;
7071	}	7074	}
7072		7075
Lines 7205-7210 Link Here
7205		7208
7206	loff_t len;	7209	loff_t len;
7207	procbuf_t pbuf = (procbuf_t ) file->private_data;	7210	procbuf_t pbuf = (procbuf_t ) file->private_data;
		7211	loff_t pos = *offset;
7208		7212
7209	ZFCP_LOG_TRACE(	7213	ZFCP_LOG_TRACE(
7210	"enter (file=0x%lx user_buf=0x%lx "	7214	"enter (file=0x%lx user_buf=0x%lx "
Lines 7212-7226 Link Here
7212	(unsigned long)file,	7216	(unsigned long)file,
7213	(unsigned long)user_buf,	7217	(unsigned long)user_buf,
7214	user_len,	7218	user_len,
7215	(unsigned long)*offset);	7219	(unsigned long)pos);
7216		7220
7217	if ( *offset>=pbuf->len) {	7221	if (pos != (unsigned long)pos \|\| pos >= pbuf->len) {
7218	return 0;	7222	return 0;
7219	} else {	7223	} else {
7220	len = min(user_len, (unsigned long)(pbuf->len - *offset));	7224	len = min(user_len, (unsigned long)(pbuf->len - pos));
7221	if (copy_to_user( user_buf, &(pbuf->buf[*offset]), len))	7225	if (copy_to_user( user_buf, &(pbuf->buf[pos]), len))
7222	return -EFAULT;	7226	return -EFAULT;
7223	(* offset) += len;	7227	*offset = pos + len;
7224	return len;	7228	return len;
7225	}	7229	}
7226		7230
Lines 7607-7612 Link Here
7607		7611
7608	loff_t len;	7612	loff_t len;
7609	procbuf_t pbuf = (procbuf_t ) file->private_data;	7613	procbuf_t pbuf = (procbuf_t ) file->private_data;
		7614	loff_t pos = *offset;
7610		7615
7611	ZFCP_LOG_TRACE(	7616	ZFCP_LOG_TRACE(
7612	"enter (file=0x%lx user_buf=0x%lx "	7617	"enter (file=0x%lx user_buf=0x%lx "
Lines 7614-7633 Link Here
7614	(unsigned long)file,	7619	(unsigned long)file,
7615	(unsigned long)user_buf,	7620	(unsigned long)user_buf,
7616	user_len,	7621	user_len,
7617	(unsigned long)*offset);	7622	(unsigned long)pos);
7618		7623
7619	if ( *offset>=pbuf->len) {	7624	if (pos != (unsigned long)pos \|\| pos >= pbuf->len) {
7620	return 0;	7625	return 0;
7621	} else {	7626	} else {
7622	len = min(user_len, (unsigned long)(pbuf->len - *offset));	7627	len = min(user_len, (unsigned long)(pbuf->len - pos));
7623	if (copy_to_user( user_buf, &(pbuf->buf[*offset]), len))	7628	if (copy_to_user( user_buf, &(pbuf->buf[pos]), len))
7624	return -EFAULT;	7629	return -EFAULT;
7625	(* offset) += len;	7630	*offset = pos + len;
7626	return len;	7631	return len;
7627	}	7632	}
7628		7633
7629	ZFCP_LOG_TRACE("Size-offset is %ld, user_len is %ld\n ",	7634	ZFCP_LOG_TRACE("Size-offset is %ld, user_len is %ld\n ",
7630	((unsigned long)(pbuf->len - *offset)),	7635	((unsigned long)(pbuf->len - pos)),
7631	user_len);	7636	user_len);
7632		7637
7633	ZFCP_LOG_TRACE("exit (%Li)\n", len);	7638	ZFCP_LOG_TRACE("exit (%Li)\n", len);

Lines 3082-3087 Link Here

(-)linux-2.4.21/drivers/scsi/osst.c (-4 / +8 lines)
3082	ST_mode * STm;	3082	ST_mode * STm;
3083	ST_partstat * STps;	3083	ST_partstat * STps;
3084	int dev = TAPE_NR(inode->i_rdev);	3084	int dev = TAPE_NR(inode->i_rdev);
		3085	loff_t pos = *ppos;
3085		3086
3086	STp = os_scsi_tapes[dev];	3087	STp = os_scsi_tapes[dev];
3087		3088
Lines 3299-3305 Link Here
3299	if (i == (-ENOSPC)) {	3300	if (i == (-ENOSPC)) {
3300	transfer = STp->buffer->writing; /* FIXME -- check this logic */	3301	transfer = STp->buffer->writing; /* FIXME -- check this logic */
3301	if (transfer <= do_count) {	3302	if (transfer <= do_count) {
3302	filp->f_pos += do_count - transfer;	3303	pos += do_count - transfer;
3303	count -= do_count - transfer;	3304	count -= do_count - transfer;
3304	if (STps->drv_block >= 0) {	3305	if (STps->drv_block >= 0) {
3305	STps->drv_block += (do_count - transfer) / STp->block_size;	3306	STps->drv_block += (do_count - transfer) / STp->block_size;
Lines 3337-3343 Link Here
3337	goto out;	3338	goto out;
3338	}	3339	}
3339		3340
3340	filp->f_pos += do_count;	3341	pos += do_count;
3341	b_point += do_count;	3342	b_point += do_count;
3342	count -= do_count;	3343	count -= do_count;
3343	if (STps->drv_block >= 0) {	3344	if (STps->drv_block >= 0) {
Lines 3359-3365 Link Here
3359	if (STps->drv_block >= 0) {	3360	if (STps->drv_block >= 0) {
3360	STps->drv_block += blks;	3361	STps->drv_block += blks;
3361	}	3362	}
3362	filp->f_pos += count;	3363	pos += count;
3363	count = 0;	3364	count = 0;
3364	}	3365	}
3365		3366
Lines 3389-3394 Link Here
3389	retval = total;	3390	retval = total;
3390		3391
3391	out:	3392	out:
		3393	*ppos = pos;
3392	if (SRpnt != NULL) scsi_release_request(SRpnt);	3394	if (SRpnt != NULL) scsi_release_request(SRpnt);
3393		3395
3394	up(&STp->lock);	3396	up(&STp->lock);
Lines 3409-3414 Link Here
3409	ST_partstat * STps;	3411	ST_partstat * STps;
3410	Scsi_Request *SRpnt = NULL;	3412	Scsi_Request *SRpnt = NULL;
3411	int dev = TAPE_NR(inode->i_rdev);	3413	int dev = TAPE_NR(inode->i_rdev);
		3414	loff_t pos = *ppos;
3412		3415
3413	STp = os_scsi_tapes[dev];	3416	STp = os_scsi_tapes[dev];
3414		3417
Lines 3534-3540 Link Here
3534	}	3537	}
3535	STp->logical_blk_num += transfer / STp->block_size;	3538	STp->logical_blk_num += transfer / STp->block_size;
3536	STps->drv_block += transfer / STp->block_size;	3539	STps->drv_block += transfer / STp->block_size;
3537	filp->f_pos += transfer;	3540	pos += transfer;
3538	buf += transfer;	3541	buf += transfer;
3539	total += transfer;	3542	total += transfer;
3540	}	3543	}
Lines 3573-3578 Link Here
3573	retval = total;	3576	retval = total;
3574		3577
3575	out:	3578	out:
		3579	*ppos = pos;
3576	if (SRpnt != NULL) scsi_release_request(SRpnt);	3580	if (SRpnt != NULL) scsi_release_request(SRpnt);
3577		3581
3578	up(&STp->lock);	3582	up(&STp->lock);

Lines 80-86 Link Here

(-)linux-2.4.21/drivers/usb/devio.c (-8 / +9 lines)
80	struct dev_state ps = (struct dev_state )file->private_data;	80	struct dev_state ps = (struct dev_state )file->private_data;
81	ssize_t ret = 0;	81	ssize_t ret = 0;
82	unsigned len;	82	unsigned len;
83	loff_t pos;	83	loff_t pos, last;
84	int i;	84	int i;
85		85
86	pos = *ppos;	86	pos = *ppos;
Lines 102-138 Link Here
102	goto err;	102	goto err;
103	}	103	}
104		104
105	*ppos += len;	105	pos += len;
106	buf += len;	106	buf += len;
107	nbytes -= len;	107	nbytes -= len;
108	ret += len;	108	ret += len;
109	}	109	}
110		110
111	pos = sizeof(struct usb_device_descriptor);	111	last = sizeof(struct usb_device_descriptor);
112	for (i = 0; nbytes && i < ps->dev->descriptor.bNumConfigurations; i++) {	112	for (i = 0; nbytes && i < ps->dev->descriptor.bNumConfigurations; i++) {
113	struct usb_config_descriptor *config =	113	struct usb_config_descriptor *config =
114	(struct usb_config_descriptor *)ps->dev->rawdescriptors[i];	114	(struct usb_config_descriptor *)ps->dev->rawdescriptors[i];
115	unsigned int length = le16_to_cpu(config->wTotalLength);	115	unsigned int length = le16_to_cpu(config->wTotalLength);
116		116
117	if (*ppos < pos + length) {	117	if (pos < last + length) {
118	len = length - (*ppos - pos);	118	len = length - (pos - last);
119	if (len > nbytes)	119	if (len > nbytes)
120	len = nbytes;	120	len = nbytes;
121		121
122	if (copy_to_user(buf,	122	if (copy_to_user(buf,
123	ps->dev->rawdescriptors[i] + (*ppos - pos), len)) {	123	ps->dev->rawdescriptors[i] + (pos - last), len)) {
124	ret = -EFAULT;	124	ret = -EFAULT;
125	goto err;	125	goto err;
126	}	126	}
127		127
128	*ppos += len;	128	pos += len;
129	buf += len;	129	buf += len;
130	nbytes -= len;	130	nbytes -= len;
131	ret += len;	131	ret += len;
132	}	132	}
133		133
134	pos += length;	134	last += length;
135	}	135	}
		136	*ppos = pos;
136		137
137	err:	138	err:
138	up_read(&ps->devsem);	139	up_read(&ps->devsem);

Lines 52-60 Link Here

(-)linux-2.4.21/drivers/usb/drivers.c (-4 / +4 lines)
52	struct list_head *tmp = usb_driver_list.next;	52	struct list_head *tmp = usb_driver_list.next;
53	char page, start, *end;	53	char page, start, *end;
54	ssize_t ret = 0;	54	ssize_t ret = 0;
55	unsigned int pos, len;	55	loff_t n = *ppos;
		56	unsigned int pos = n, len;
56		57
57	if (*ppos < 0)	58	if (pos != n)
58	return -EINVAL;	59	return -EINVAL;
59	if (nbytes <= 0)	60	if (nbytes <= 0)
60	return 0;	61	return 0;
Lines 64-70 Link Here
64	return -ENOMEM;	65	return -ENOMEM;
65	start = page;	66	start = page;
66	end = page + (PAGE_SIZE - 100);	67	end = page + (PAGE_SIZE - 100);
67	pos = *ppos;
68	for (; tmp != &usb_driver_list; tmp = tmp->next) {	68	for (; tmp != &usb_driver_list; tmp = tmp->next) {
69	struct usb_driver *driver = list_entry(tmp, struct usb_driver, driver_list);	69	struct usb_driver *driver = list_entry(tmp, struct usb_driver, driver_list);
70	int minor = driver->fops ? driver->minor : -1;	70	int minor = driver->fops ? driver->minor : -1;
Lines 88-94 Link Here
88	if (copy_to_user(buf, page + pos, len))	88	if (copy_to_user(buf, page + pos, len))
89	ret = -EFAULT;	89	ret = -EFAULT;
90	else	90	else
91	*ppos += len;	91	*ppos = pos + len;
92	}	92	}
93	free_page((unsigned long)page);	93	free_page((unsigned long)page);
94	return ret;	94	return ret;

Lines 530-545 Link Here

(-)linux-2.4.21/drivers/usb/host/uhci-debug.h (-7 / +5 lines)
530	loff_t *ppos)	530	loff_t *ppos)
531	{	531	{
532	struct uhci_proc *up = file->private_data;	532	struct uhci_proc *up = file->private_data;
533	unsigned int pos;	533	loff_t n = *ppos;
		534	unsigned int pos = n;
534	unsigned int size;	535	unsigned int size;
535		536
536	pos = *ppos;
537	size = up->size;	537	size = up->size;
538	if (pos >= size)	538	if (pos != n \|\| pos >= size)
539	return 0;	539	return 0;
540	if (nbytes >= size)	540	if (nbytes > size - pos)
541	nbytes = size;
542	if (pos + nbytes > size)
543	nbytes = size - pos;	541	nbytes = size - pos;
544		542
545	if (!access_ok(VERIFY_WRITE, buf, nbytes))	543	if (!access_ok(VERIFY_WRITE, buf, nbytes))
Lines 547-553 Link Here
547		545
548	copy_to_user(buf, up->data + pos, nbytes);	546	copy_to_user(buf, up->data + pos, nbytes);
549		547
550	*ppos += nbytes;	548	ppos = pos + nbytes;
551		549
552	return nbytes;	550	return nbytes;
553	}	551	}

Lines 403-411 Link Here

(-)linux-2.4.21/drivers/video/fbmem.c (-8 / +4 lines)
403	fb->fb_get_fix(&fix,PROC_CONSOLE(info), info);	403	fb->fb_get_fix(&fix,PROC_CONSOLE(info), info);
404	if (p >= fix.smem_len)	404	if (p >= fix.smem_len)
405	return 0;	405	return 0;
406	if (count >= fix.smem_len)	406	if (count > fix.smem_len - p)
407	count = fix.smem_len;
408	if (count + p > fix.smem_len)
409	count = fix.smem_len - p;	407	count = fix.smem_len - p;
410	if (count) {	408	if (count) {
411	char *base_addr;	409	char *base_addr;
Lines 414-420 Link Here
414	count -= copy_to_user(buf, base_addr+p, count);	412	count -= copy_to_user(buf, base_addr+p, count);
415	if (!count)	413	if (!count)
416	return -EFAULT;	414	return -EFAULT;
417	*ppos += count;	415	*ppos = p + count;
418	}	416	}
419	return count;	417	return count;
420	}	418	}
Lines 436-445 Link Here
436	fb->fb_get_fix(&fix, PROC_CONSOLE(info), info);	434	fb->fb_get_fix(&fix, PROC_CONSOLE(info), info);
437	if (p > fix.smem_len)	435	if (p > fix.smem_len)
438	return -ENOSPC;	436	return -ENOSPC;
439	if (count >= fix.smem_len)
440	count = fix.smem_len;
441	err = 0;	437	err = 0;
442	if (count + p > fix.smem_len) {	438	if (count > fix.smem_len - p) {
443	count = fix.smem_len - p;	439	count = fix.smem_len - p;
444	err = -ENOSPC;	440	err = -ENOSPC;
445	}	441	}
Lines 448-454 Link Here
448		444
449	base_addr = info->disp->screen_base;	445	base_addr = info->disp->screen_base;
450	count -= copy_from_user(base_addr+p, buf, count);	446	count -= copy_from_user(base_addr+p, buf, count);
451	*ppos += count;	447	*ppos = p + count;
452	err = -EFAULT;	448	err = -EFAULT;
453	}	449	}
454	if (count)	450	if (count)