There is a potential integer overflow in do_insnlist_ioctl() if
userspace passes in a large insnlist.n_insns. The call to kmalloc()
would allocate a small buffer, leading to a memory corruption.
The bug was reported by Dan Carpenter <dan.carpenter@oracle.com>
and Haogang Chen <haogangchen@gmail.com>. The patch was suggested by
Ian Abbott <abbotti@mev.co.uk> and Lars-Peter Clausen <lars@metafoo.de>.
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Reported-by: Haogang Chen <haogangchen@gmail.com>.
Cc: Ian Abbott <abbotti@mev.co.uk>
Cc: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This reverts commit e384a41141.
It's not the correct way to solve this issue.
Acked-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
There is an integer overflow here that could cause memory corruption
on 32 bit systems.
insnlist.n_insns could be a very high value size calculation for
kmalloc() could overflow resulting in a smaller "insns" than
expected. In the for (i = 0; i < insnlist.n_insns; i++) {... loop
we would read past the end of the buffer, possibly corrupting memory
as well.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
After sleeping on a wait queue, signal_pending(current) should be
checked (not before sleeping).
Acked-by: Alessandro Rubini <rubini@gnudd.com>
Signed-off-by: Federico Vaga <federico.vaga@gmail.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
In comedi_fops, mmap_count is decremented at comedi_vm_ops->close but
it is not incremented at comedi_vm_ops->open. This may result in a negative
counter. The patch introduces the open method to keep the counter
consistent.
The bug was triggerd by this sample code:
mmap(0, ...., comedi_fd);
fork();
exit(0);
Acked-by: Alessandro Rubini <rubini@gnudd.com>
Signed-off-by: Federico Vaga <federico.vaga@gmail.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This fixes kernel oops when an USB DAQ device is plugged out while it's
communicating with the userspace software.
Signed-off-by: Bernd Porr <berndporr@f2s.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This is a patch to the ni_atmio.c file which fixes a brace and whitespace warning found by the checkpatch.pl tool
Signed-off-by: Jake Burton <jake5991@live.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
drivers: staging: comedi: cb_das16_cs.c
fixed over 80 line issue, and removed a space before tab issue.
Signed-off-by: Christopher Rice <rice.christopher.a@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Added log subject to printk()s in drivers/staging/comedi/drivers/pcmmio.c.
Signed-off-by: Johannes Thumshirn <morbidrsa@googlemail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This adds a new driver file usbduxsigma which is the driver for
a new board by ITL. The driver has been tested and is working fine.
Signed-off-by: Bernd Porr <berndporr@f2s.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Fix build errors when CONFIG_COMEDI_PCI_DRIVERS is not enabled
and CONFIG_COMEDI_PCI_DRIVERS was used where CONFIG_ISA_DMA_API
should have been used.
drivers/staging/comedi/drivers/ni_labpc.c: In function 'labpc_ai_cmd':
drivers/staging/comedi/drivers/ni_labpc.c:1351: error: implicit declaration of function 'labpc_suggest_transfer_size'
drivers/staging/comedi/drivers/ni_labpc.c: At top level:
drivers/staging/comedi/drivers/ni_labpc.c:1802: error: conflicting types for 'labpc_suggest_transfer_size'
drivers/staging/comedi/drivers/ni_labpc.c:1351: note: previous implicit declaration of 'labpc_suggest_transfer_size' was here
Signed-off-by: Randy Dunlap <rdunlap@xenotime.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This patch removes initialization of static to 0 or NULL error found
by checkpatch.pl tool
Signed-off-by: Bojan Prtvar <prtvar.b@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This is a patch to adv_pci_dio.c that fixes an error initializing
static struct pci_dio_private *pci_priv to NULL
removed the initialization.
found by the checkpatch.pl tool.
Signed-off-by: Mariano Guerra <luismarianoguerra@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
comedi_fops.c : A forward decleration was declared as extern although it
is a function private to this file. Changed the
decleration to static.
Signed-off-by: Mark Pearson <markpearson_de@yahoo.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This is a patch to the rtd520.c file that fixes up a printk warning found by the checkpatch.pl tool
Signed-off-by: Ravishankr <ravishakarkm32@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This is a patch to the rtd520.c file that fixes up a warning: line over 80 character found by the checkpatch.pl tool
Signed-off-by: Ravishankar <ravishankarkm32@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This is a patch to the unioxx5.c file that fixes up a warning found by the checkpatch.pl tool
Signed-off-by: Ravishankar <ravishankarkm32@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This is a patch to the serial2002.c file that fixes up a brace warning found by the checkpatch.pl tool
Signed-off-by: Ravishankar <ravishankarkm32@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This is a patch to the serial2002.c file that fixes up a brace and printk warning found by the checkpatch.pl tool
Signed-off-by: Ravishankar <ravishankarkm32@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This is no longer needed as the code is now in the main kernel tree.
Signed-off-by: Pavel Roskin <proski@gnu.org>
Cc: Frank Mori Hess <fmhess@users.sourceforge.net>
Cc: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This is a patch to the ni_daq_700.c file that fixes up a prink warning found by the checkpatch.pl tool
Signed-off-by: Ravishankar <ravishankarkm32@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Fix ni_labpc.c to build when CONFIG_ISA_DMA_API is not enabled.
This is a driver that supports both ISA and PCI devices.
It now builds when for PCI-only support or for both
ISA and PCI device support.
(It does not support ISA-only without PCI.)
Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com>
Cc: Ian Abbott <abbotti@mev.co.uk>
Cc: Frank Mori Hess <fmhess@users.sourceforge.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
driver_name and board_name are pointers to strings, not buffers of size
COMEDI_NAMELEN. Copying COMEDI_NAMELEN bytes of a string containing
less than COMEDI_NAMELEN-1 bytes would leak some unrelated bytes.
Signed-off-by: Vasiliy Kulikov <segoon@openwall.com>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Smatch complains about a couple error paths where the semaphores
were not released.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Add dyna_pci10xx entry to comedi Kconfig and Makefile
Signed-off-by: Prashant P. Shah <pshah.mumbai@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
For Dynalog PCI DAQ cards:
PCI-1050
Signed-off-by: Prashant P. Shah <pshah.mumbai@gmail.com>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This handles the merge conflicts with the
drivers/staging/brcm80211/Kconfig file due to changes on the two
different branches.
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Small fix in adv_pci1723.c for a "whitespace before quoted newline" warning
from checkpatch.pl
Signed-off-by: Matt Billenstein <matt@vazor.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Some platforms do not have virt_to_bus(), so properly depend on
CONFIG_VIRT_TO_BUS for the Comedi drivers that need this function.
Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
On architectures that don't define PAGE_KERNEL_NOCACHE, the Comedi driver turns
into tragedy:
CC [M] drivers/staging/comedi/drivers.o
drivers/staging/comedi/drivers.c: In function ‘comedi_buf_alloc’:
drivers/staging/comedi/drivers.c:505:41: error: ‘PAGE_KERNEL_NOCACHE’ undeclared (first use in this function)
drivers/staging/comedi/drivers.c:505:41: note: each undeclared identifier is rep orted only once for each function it appears in
make[3]: *** [drivers/staging/comedi/drivers.o] Error 1
Restrict the driver to only those architectures that define PAGE_KERNEL_NOCACHE.
PAGE_KERNEL_NOCACHE is a kludge - some system architectures such as SGI IP27
are even uable to offer uncached operation - at least in the way an unwitting
driver might assume. I haven't looked in details how the driver is using
the area vmaped with PAGE_KERNEL_NOCACHE but maybe doing it XFS-style using
cached memory and the flush_kernel_vmap_range / invalidate_kernel_vmap_range
APIs in conjunction with the DMA API is a practical alternative.
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Reported-by: David Miller <davem@davemloft.net>
Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
Acked-by: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: Martyn Welch <martyn.welch@ge.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
On some arches the function virt_to_bus() wasn't being pulled in due to
include chains being different. So, as we are explicitly calling this
function, explicitly include the proper header file so all will build
properly.
Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Not all arches have PAGE_KERNEL_NOCACHE, so use the "normal" PAGE_KERNEL
on those that do not have it.
Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* git://git.kernel.org/pub/scm/linux/kernel/git/brodo/pcmcia-2.6:
pcmcia: Make struct pcmcia_device_id const, sound drivers edition
staging: pcmcia: Convert pcmcia_device_id declarations to const
pcmcia: Convert pcmcia_device_id declarations to const
pcmcia: Make declaration and uses of struct pcmcia_device_id const
pcmcia/sa1100: put sa11x0_pcmcia_hw_init[] to .devinit.data
Add support for automatically associating a vmk8055 device with a
comedi device (previously the user had to use comedi_num_legacy_minors
to reserve device slots and then associate them with vmk8055 devices
using comedi_config).
Tested on multiple K8055s, but not on K8061s.
Signed-off-by: J. Ali Harlow <ali@avrc.city.ac.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Calling comedi_dio_bifield2() returns EBUSY permanently. Implementing
the insn_bits call fixes the problem and is good in its own right since
one can then read and write to all the digitial lines at the same time.
Tested on a K8055, but not on a K8061.
Signed-off-by: J. Ali Harlow <ali@avrc.city.ac.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
rudimentary_check() can currently check whether the input or
output direction is currently available (no pending transaction),
but not both at the same time. We need this facility for do_bits().
Signed-off-by: J. Ali Harlow <ali@avrc.city.ac.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
vmk80xx_di_rinsn() and vmk80xx_do_rinsn() extract the required channel
data by inconsistent and overly-complex algorithms. Simplify them both.
Signed-off-by: J. Ali Harlow <ali@avrc.city.ac.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Digitial input and output sub-devices were reporting a maxdata of
0x1F and 0xFF respectively. They should both be 1.
Signed-off-by: J. Ali Harlow <ali@avrc.city.ac.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
rudimentary_check is a macro with side-effects (it returns
on error) which is contary to CodingStyle. Replace it with
a static function.
Signed-off-by: J. Ali Harlow <ali@avrc.city.ac.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
The ps_BoardInfo pointer in the device private data is redundant as we
can just use the this_board macro to access the same data, as is done
elsewhere in the code. Get rid of the pointer and change the code to
use the this_board macro instead.
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
The drivers for ADDI-DATA cards can override some static parameters for
the board type using information read from EEPROM. Unfortunately, they
currently write the parameters from the EEPROM back to the shared,
read-only board data! The problem has been masked during compilation by
type-casting away the const-ness of the data.
This patch changes the code to use an area in the private data for the
board instance to hold the parameters read from EEPROM (after
initializing the parameters from the static board data). It also
changes the type-casts to the read-only data to preserve the const
qualifier.
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
The Advantech PCI-1751 has a 8254 counter chip on board. Add it to the
device as a counter subdevice. Apparently the counter can generate
interrupts although the driver does not currently use this capability.
Original patch by Ivan Russkih (Иван Русских) <vanekrus at gmail dot
com>.
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Style improvements to comedi driver vmk80xx:
* One variable definition per line
* Block quotes start and end with near-empty lines
* If..else statements use braces for both branches
* Egregious blank lines removed
* Use if..else rather than goto where trivial
* Don't put function return type on a separate line
Signed-off-by: J. Ali Harlow <ali@avrc.city.ac.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This is a patch to the jr3_pci.c file that fixes up a brace warning
found by the checkpatch.pl tool
Signed-off-by: Stephane Pajot <pajot.stephane@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
