staging: ion: Fix ION_IOC_FREE compat ioctl

The compat ioctl for ION_IOC_FREE currently passes allocation data
instead of the free data. Correct this.

Cc: Colin Cross <ccross@android.com>
Cc: Android Kernel Team <kernel-team@android.com>
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
[jstultz: Folded in a small build fix]
Signed-off-by: John Stultz <john.stultz@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/staging/android/ion/compat_ion.c b/drivers/staging/android/ion/compat_ion.c
index af6cd370b30f3e890e5edc9bdec864efb4f8b9b8..ee3a7380e53b129ed04320940d6cae57cbbd4226 100644 (file)
--- a/drivers/staging/android/ion/compat_ion.c
+++ b/drivers/staging/android/ion/compat_ion.c
@@ -35,9 +35,14 @@ struct compat_ion_custom_data {
        compat_ulong_t arg;
 };
 
+struct compat_ion_handle_data {
+       compat_int_t handle;
+};
+
 #define COMPAT_ION_IOC_ALLOC   _IOWR(ION_IOC_MAGIC, 0, \
                                      struct compat_ion_allocation_data)
-#define COMPAT_ION_IOC_FREE    _IOWR(ION_IOC_MAGIC, 1, struct ion_handle_data)
+#define COMPAT_ION_IOC_FREE    _IOWR(ION_IOC_MAGIC, 1, \
+                                     struct compat_ion_handle_data)
 #define COMPAT_ION_IOC_CUSTOM  _IOWR(ION_IOC_MAGIC, 6, \
                                      struct compat_ion_custom_data)
 
@@ -64,6 +69,19 @@ static int compat_get_ion_allocation_data(
        return err;
 }
 
+static int compat_get_ion_handle_data(
+                       struct compat_ion_handle_data __user *data32,
+                       struct ion_handle_data __user *data)
+{
+       compat_int_t i;
+       int err;
+
+       err = get_user(i, &data32->handle);
+       err |= put_user(i, &data->handle);
+
+       return err;
+}
+
 static int compat_put_ion_allocation_data(
                        struct compat_ion_allocation_data __user *data32,
                        struct ion_allocation_data __user *data)
@@ -132,8 +150,8 @@ long compat_ion_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
        }
        case COMPAT_ION_IOC_FREE:
        {
-               struct compat_ion_allocation_data __user *data32;
-               struct ion_allocation_data __user *data;
+               struct compat_ion_handle_data __user *data32;
+               struct ion_handle_data __user *data;
                int err;
 
                data32 = compat_ptr(arg);
@@ -141,7 +159,7 @@ long compat_ion_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
                if (data == NULL)
                        return -EFAULT;
 
-               err = compat_get_ion_allocation_data(data32, data);
+               err = compat_get_ion_handle_data(data32, data);
                if (err)
                        return err;