linux-stable.git/drivers/staging/comedi, branch linux-3.5.y

staging: comedi: fix memory leak for saved channel list

2012-10-07T15:35:52+00:00

commit c8cad4c89ee3b15935c532210ae6ebb5c0a2734d upstream.

When `do_cmd_ioctl()` allocates memory for the kernel copy of a channel
list, it frees any previously allocated channel list in
`async->cmd.chanlist` and replaces it with the new one.  However, if the
device is ever removed (or "detached") the cleanup code in
`cleanup_device()` in "drivers.c" does not free this memory so it is
lost.

A sensible place to free the kernel copy of the channel list is in
`do_become_nonbusy()` as at that point the comedi asynchronous command
associated with the channel list is no longer valid.  Free the channel
list in `do_become_nonbusy()` instead of `do_cmd_ioctl()` and clear the
pointer to prevent it being freed more than once.

Note that `cleanup_device()` could be called at an inappropriate time
while the comedi device is open, but that's a separate bug not related
to this this patch.

Signed-off-by: Ian Abbott 
Signed-off-by: Greg Kroah-Hartman

staging: comedi: don't dereference user memory for INSN_INTTRIG

2012-10-07T15:35:52+00:00

commit 5d06e3df280bd230e2eadc16372e62818c63e894 upstream.

`parse_insn()` is dereferencing the user-space pointer `insn->data`
directly when handling the `INSN_INTTRIG` comedi instruction.  It
shouldn't be using `insn->data` at all; it should be using the separate
`data` pointer passed to the function.  Fix it.

Signed-off-by: Ian Abbott 
Signed-off-by: Greg Kroah-Hartman

staging: comedi: jr3_pci: fix iomem dereference

2012-10-07T15:35:52+00:00

commit e1878957b4676a17cf398f7f5723b365e9a2ca48 upstream.

Correct a direct dereference of I/O memory to use an appropriate I/O
memory access function.  Note that the pointer being dereferenced is not
currently tagged with `__iomem` but I plan to correct that for 3.7.

Signed-off-by: Ian Abbott 
Signed-off-by: Greg Kroah-Hartman

staging: comedi: s626: don't dereference insn->data

2012-10-07T15:35:52+00:00

commit b655c2c4782ed3e2e71d2608154e295a3e860311 upstream.

`s626_enc_insn_config()` is incorrectly dereferencing `insn->data` which
is a pointer to user memory.  It should be dereferencing the separate
`data` parameter that points to a copy of the data in kernel memory.

Signed-off-by: Ian Abbott 
Reviewed-by: H Hartley Sweeten 
Signed-off-by: Greg Kroah-Hartman

staging: comedi: das08: Correct AI encoding for das08jr-16-ao

2012-10-02T17:39:03+00:00

commit e6391a182865efc896cb2a8d79e07b7ac2f45b48 upstream.

The element of `das08_boards[]` for the 'das08jr-16-ao' board has the
`ai_encoding` member set to `das08_encode12`.  It should be set to
`das08_encode16` same as the 'das08jr/16' board.  After all, this board
has 16-bit AI resolution.

The description of the A/D LSB register at offset 0 seems incorrect in
the user manual "cio-das08jr-16-ao.pdf" as it implies that the AI
resolution is only 12 bits.  The diagrams of the A/D LSB and MSB
registers show 15 data bits and a sign bit, which matches what the
software expects for the `das08_encode16` AI encoding method.

Signed-off-by: Ian Abbott 
Signed-off-by: Greg Kroah-Hartman

staging: comedi: das08: Correct AO output for das08jr-16-ao

2012-10-02T17:39:01+00:00

commit 61ed59ed09e6ad2b8395178ea5ad5f653bba08e3 upstream.

Don't zero out bits 15..12 of the data value in `das08jr_ao_winsn()` as
that knobbles the upper three-quarters of the output range for the
'das08jr-16-ao' board.

Signed-off-by: Ian Abbott 
Signed-off-by: Greg Kroah-Hartman

staging: comedi: amplc_pci224: Fix PCI ref count

2012-10-02T17:39:01+00:00

commit cadf84bfeb80e216fde328d357fe856160157d2c upstream.

When attaching a PCI device manually via the comedi driver `attach` hook
(`pci224_attach()`) (called by the comedi core for the
`COMEDI_DEVCONFIG` ioctl), its reference count is incremented in the
`for_each_pci_dev` loop (in `pci224_find_pci_dev()`).  It is decremented
when the `detach` hook (`pci224_detach()`) is called to detach the
device.  However, when the PCI device is attached automatically via the
`attach_pci` hook (`pci224_attach_pci()`, called at probe time via
`comedi_pci_auto_config()`) it's reference count is not incremented so
there will be an unmatched decrement when detaching the device.

Increment the PCI device reference count in `pci224_attach_pci()` to
correct the mismatch.

Once support for manual configuration has been removed from this driver,
the calls to `pci_dev_get()` and `pci_dev_put()` can be removed.

Signed-off-by: Ian Abbott 
Signed-off-by: Greg Kroah-Hartman

staging: comedi: Fix reversed test in comedi_device_attach()

2012-08-26T02:31:43+00:00

commit 80eb7a506fdcea08f86c9dfc7c638303bf02a3c8 upstream.

Commit 3902a370281d2f2b130f141e8cf94eab40125769 (staging: comedi:
refactor comedi_device_attach() a bit) by yours truly introduced an
inverted logic bug in comedi_device_attach() for the case where the
driver expects the device to be configured by driver name rather than
board name.  The result of a strcmp() is being tested incorrectly.  Fix
it.

Thanks to Stephen N Chivers for discovering the bug and suggesting the
fix.

Signed-off-by: Ian Abbott 
Signed-off-by: Greg Kroah-Hartman

staging/comedi: fix build for USB not enabled

2012-06-11T23:49:35+00:00

Calls to optional subsystems cannot be made indiscriminately.
Enclose all of the usb helper functions inside
#if IS_ENABLED(CONFIG_USB)
to fix these build errors.

(The pci helper functions are OK since there are stubs in
linux/pci.h for the called functions when PCI is not enabled.
Possibly the same could be done for the called USB functions.)

ERROR: "usb_deregister" [drivers/staging/comedi/comedi.ko] undefined!
ERROR: "usb_register_driver" [drivers/staging/comedi/comedi.ko] undefined!

Signed-off-by: Randy Dunlap 
Cc: Ian Abbott 
Cc: Frank Mori Hess 
Signed-off-by: Greg Kroah-Hartman

staging: comedi: cleanup all the comedi_driver 'detach' functions

2012-05-19T00:29:55+00:00

1. Change the return type from int to void

All the detach functions, except for the comedi usb drivers, simply
return success (0). Plus, the return code is never checked in the
comedi core.

The comedi usb drivers do return error codes but the conditions can
never happen.

The first check is:

	if (!dev)
		return -EFAULT;

This checks that the passed comedi_device pointer is valid. The detach
function itself is called using this pointer so it MUST always be valid
or there is a bug in the core:

	if (dev->driver)
		dev->driver->detach(dev);

And the second check:

	usb = dev->private;
	if (!usb)
		return -EFAULT;

The dev->private pointer is setup in the attach function to point to the
probed usb device. This value could be NULL if the attach fails. But,
since the comedi core is going to unload the driver anyway and does not
check for errors there is no gain by returning one.

After removing these checks from the comedi usb drivers the detach
functions required a bit of cleanup.

2. Remove all the printk noise in the detach functions

All of the printk output is really just noise. The user did a rmmod to
unload the driver, we really don't need to tell them about it.

Also, some of the messages are output using:

	dev_dbg(dev->hw_dev, ...
or
	dev_info(dev->hw_dev, ...

Unfortunately the hw_dev value is only used by drivers that are doing
DMA. For most drivers this variable is going to be NULL so the output
is not going to work as expected.

3. Refactor a couple static 'free_resource' functions into the detach
   functions.

The 'free_resource' function is only being called by the detach and it
makes more sense to just absorb the code.

4. Remove a couple unnecessary braces for single statements.

5. Remove unnecessary comments.

Most of the comedi drivers appear to be based on the comedi skel driver
and have the comments from that driver included. These comments make
sense in the skel driver for reference but they don't need to be in any
of the actual drivers.

6. Remove all the extra whitespace.

It's not needed to make the functions any more readable.

7. Remove the now unused 'attached_successfully' variable in the
   cb_pcimdda driver.

This variable was only used to conditionally output some driver noise
during the detach. Since all the printk's have been removed this
variable is no longer necessary.

Signed-off-by: H Hartley Sweeten 
Cc: Ian Abbott 
Cc: Mori Hess 
Signed-off-by: Greg Kroah-Hartman