linux-stable.git/drivers/staging/comedi, branch linux-3.17.y

staging: comedi: fix memory leak / bad pointer freeing for chanlist

2014-11-14T18:10:37+00:00

commit 238b5ad855924919e5b98d0c772d9dc78795639b upstream.

As a follow-up to commit 6cab7a37f5c04 ("staging: comedi: (regression)
channel list must be set for COMEDI_CMD ioctl"), Hartley Sweeten pointed
out another couple of bugs stemming from commit 6cab7a37f5c04 ("staging:
comedi: comedi_fops: introduce __comedi_get_user_chanlist()").

Firstly, `do_cmdtest_ioctl()` never frees the kernel copy of the user
chanlist allocated by `__comedi_get_user_chanlist()`, so that memory is
leaked.  Fix it by freeing the allocated kernel memory pointed to by
`cmd.chanlist` before that pointer is overwritten with its original
pointer to user memory before `cmd` is copied back to user-space.

Secondly, if `__comedi_get_user_chanlist()` returns an error,
`cmd->chanlist` is left unchanged and in fact will be a pointer to user
memory.  This causes `do_cmd_ioctl()` to `goto cleanup` and call
`do_become_nonbusy()` which would attempt to free the memory pointed to
by the user-space pointer.  Fix it by setting `cmd->chanlist` to NULL at
the start of `__comedi_get_user_chanlist()`.

Fixes: c6cd0eefb27b ("staging: comedi: comedi_fops: introduce __comedi_get_user_chanlist()")
Reported-by: H Hartley Sweeten 
Signed-off-by: Greg Kroah-Hartman

staging: comedi: (regression) channel list must be set for COMEDI_CMD ioctl

2014-11-14T18:10:37+00:00

commit 6cab7a37f5c048bb2a768f24b0ec748b052fda09 upstream.

`do_cmd_ioctl()`, the handler for the `COMEDI_CMD` ioctl can incorrectly
call the Comedi subdevice's `do_cmd()` handler with a NULL channel list
pointer.  This is a regression as the `do_cmd()` handler has never been
expected to deal with that, leading to a kernel OOPS when it tries to
dereference it.

A NULL channel list pointer is allowed for the `COMEDI_CMDTEST` ioctl,
handled by `do_cmdtest_ioctl()` and the subdevice's `do_cmdtest()`
handler, but not for the `COMEDI_CMD` ioctl and its handlers.

Both `do_cmd_ioctl()` and `do_cmdtest_ioctl()` call
`__comedi_get_user_chanlist()` to copy the channel list from user memory
into dynamically allocated kernel memory and check it for consistency.
That function currently returns 0 if the `user_chanlist` parameter
(pointing to the channel list in user memory) is NULL.  That's fine for
`do_cmdtest_ioctl()`, but `do_cmd_ioctl()` incorrectly assumes the
kernel copy of the channel list has been set-up correctly.

Fix it by not allowing the `user_chanlist` parameter to be NULL in
`__comedi_get_user_chanlist()`, and only calling it from
`do_cmdtest_ioctl()` if the parameter is non-NULL.

Thanks to Bernd Porr for reporting the bug via an initial patch sent
privately.

Fixes: c6cd0eefb27b ("staging: comedi: comedi_fops: introduce __comedi_get_user_chanlist()")
Reported-by: Bernd Porr 
Signed-off-by: Ian Abbott 
Reviewed-by: H Hartley Sweeten 
Cc: Bernd Porr 
Signed-off-by: Greg Kroah-Hartman

staging: comedi: addi_apci_1564: remove diagnostic interrupt support code

2014-08-01T22:37:22+00:00

As per Ian, at this point in time it is not worth implementing an async
command interface for diagnostic interrupts for this board.  As this is
the case, this patch removes the code which supports such interrupts as it
is now unused.

This includes removing apci1564_do_read(), which was the insn_read
operation for the digital output subdevice, since all it was doing was
reading the current diagnostic interrupt type and returning it in 'data'.
This doesn't follow the comedi API and this operation can be emulated by
the comedi core anyway since the insn_bits operation follows the comedi
API.  So it is safe to simply remove this function.

Signed-off-by: Chase Southwood 
Reviewed-by: Ian Abbott 
Cc: H Hartley Sweeten 
Signed-off-by: Greg Kroah-Hartman

staging: comedi: addi_apci_1564: add subdevice to check diagnostic status

2014-08-01T22:37:22+00:00

This board provides VCC/CC diagnostic information, and it also supports
diagnostic interrupts.  However, as per Ian, these interrupts aren't very
useful and it is enough to simply provide an interface for accessing the
diagnostic status on-demand.  This patch adds a 2-channel digital input
subdevice with an insn_bits handler to access this information.

Signed-off-by: Chase Southwood 
Reviewed-by: Ian Abbott 
Cc: H Hartley Sweeten 
Signed-off-by: Greg Kroah-Hartman

staging: comedi: ii_pci20kc: request and ioremap memory

2014-08-01T22:00:18+00:00

The "ii_pci20kc" module is a comedi driver for Intelligent Instruments
PCI-20001C carrier board and modules.  Despite the name, this is
actually an ISA board and uses 1K of ISA memory space (below 1M) for the
main board plus up to three modules.  The address is set by hardware
jumpers.

When the board is attached to Comedi via the `COMEDI_DEVCONFIG` ioctl
and the driver's legacy "attach" handler, the base address is passed in.
The driver currently uses that address as-is, which is a bad idea.  It
doesn't even reserve the memory region.

Fix that by sanity checking the passed in address, reserving the memory
region and ioremapping it.

Replace the current "detach" handler `comedi_legacy_detach()` with a new
handler `ii20k_detach()` which unmaps the memory and releases the
region.

Signed-off-by: Ian Abbott 
Reviewed-by: H Hartley Sweeten 
Signed-off-by: Greg Kroah-Hartman

staging: comedi: ni_tio: remove some dead code

2014-08-01T21:50:04+00:00

These conditions can never be true because "i" is always one more than
NI_660X_MAX_RTSI_CHAN after the loop.

Signed-off-by: Dan Carpenter 
Reviewed-by: H Hartley Sweeten 
Reviewed-by: Ian Abbott 
Signed-off-by: Greg Kroah-Hartman

staging: comedi: amplc_dio200: use the comedi_device 'mmio' member

2014-07-30T23:55:16+00:00

The amplc_dio200_common module currently uses a union in the private
data to determine if the hardware uses port or memory mapped I/O.

Use the new 'mmio' member in the comedi_device for the ioremap'ed
base address and remove all the union code.

Signed-off-by: H Hartley Sweeten 
Reviewed-by: Ian Abbott 
Signed-off-by: Greg Kroah-Hartman

staging: comedi: ii_pci20kc: use the comedi_device 'mmio' member

2014-07-30T23:55:16+00:00

Use the new 'mmio' member in the comedi_device for the __iomem * base
address.

Since this was the only member in the private data, remove the struct
and its allocation.

This legacy driver is a bit strange. The base address of the board is
passed to the (*attach) using by the user using the comedi_config
utiltiy. This base address is currently not ioremap'ed and is simply
cast to a void __iomem *. I'm not sure if this is correct. Add a
comment so it will be addressed later.

Signed-off-by: H Hartley Sweeten 
Reviewed-by: Ian Abbott 
Signed-off-by: Greg Kroah-Hartman

staging: comedi: ni_labpc: use the comedi_device 'mmio' member

2014-07-30T23:55:16+00:00

Use the new 'mmio' member in the comedi_device for the ioremap'ed
base address.

Only the ni_labpc_pci module does the ioremap, its also the only
module that sets the 'has_mmio' member in the boardinfo. Remove
this member from the boardinfo and use dev->mmio to determine if
the I/O is memory mapped.

Signed-off-by: H Hartley Sweeten 
Reviewed-by: Ian Abbott 
Signed-off-by: Greg Kroah-Hartman

staging: comedi: ni_labpc: refactor labpc_8255_mmio()

2014-07-30T23:55:16+00:00

Refactor the 8255 support code in preperation for using the comedi_device
'mmio' member.

Signed-off-by: H Hartley Sweeten 
Reviewed-by: Ian Abbott 
Signed-off-by: Greg Kroah-Hartman