linux-stable.git/drivers/staging/comedi, branch v3.18

staging: comedi: fix memory leak / bad pointer freeing for chanlist

2014-10-29T08:18:31+00:00

As a follow-up to commit 6cab7a37f5c04 ("staging: comedi: (regression)
channel list must be set for COMEDI_CMD ioctl"), Hartley Sweeten pointed
out another couple of bugs stemming from commit 6cab7a37f5c04 ("staging:
comedi: comedi_fops: introduce __comedi_get_user_chanlist()").

Firstly, `do_cmdtest_ioctl()` never frees the kernel copy of the user
chanlist allocated by `__comedi_get_user_chanlist()`, so that memory is
leaked.  Fix it by freeing the allocated kernel memory pointed to by
`cmd.chanlist` before that pointer is overwritten with its original
pointer to user memory before `cmd` is copied back to user-space.

Secondly, if `__comedi_get_user_chanlist()` returns an error,
`cmd->chanlist` is left unchanged and in fact will be a pointer to user
memory.  This causes `do_cmd_ioctl()` to `goto cleanup` and call
`do_become_nonbusy()` which would attempt to free the memory pointed to
by the user-space pointer.  Fix it by setting `cmd->chanlist` to NULL at
the start of `__comedi_get_user_chanlist()`.

Fixes: c6cd0eefb27b ("staging: comedi: comedi_fops: introduce __comedi_get_user_chanlist()")
Reported-by: H Hartley Sweeten 
Cc:  # 3.15.y 3.16.y 3.17.y: 6cab7a37f5c04
Cc:  # 3.15.y 3.16.y 3.17.y

Signed-off-by: Greg Kroah-Hartman

staging: comedi: Kconfig: fix config COMEDI_ADDI_APCI_3120 dependants

2014-10-29T08:18:31+00:00

A merge conflict between commits
fbfd9c8a1782f33d7b67294b2a42587063e61c0c ("staging: comedi:
addi_apci_3120: use dma_alloc_coherent()") and
aff5b1f8eb71b64bb613dc64c50b6904e89f79b9 ("staging: comedi: remove
comedi_fc module") left the COMEDI_ADDI_APCI_3120 config option
depending on VIRT_TO_BUS when it no longer needs to do so.  The
dependency was removed by the first commit and accidentally reinstated
by the second commit.  Remove the dependency again.

Signed-off-by: Ian Abbott 
Signed-off-by: Greg Kroah-Hartman

staging: comedi: widen subdevice number argument in ioctl handlers

2014-10-29T08:18:31+00:00

For the `COMEDI_LOCK`, `COMEDI_UNLOCK`, `COMEDI_CANCEL`, and
`COMEDI_POLL` ioctls the third argument is a comedi subdevice number.
This is passed as an `unsigned long`, but when it is passed down to the
ioctl command-specific handler functions `do_lock_ioctl()`,
`do_unlock_ioctl()`, `do_cancel_ioctl()`, and `do_poll_ioctl()`, the
value has been narrowed to an `unsigned int`.  Pass through the argument
as an `unsigned long` to avoid truncating the value on 64-bit
architectures.

Signed-off-by: Ian Abbott 
Signed-off-by: Greg Kroah-Hartman

drivers/staging/comedi/Kconfig: Let COMEDI_II_PCI20KC depend on HAS_IOMEM

2014-10-20T02:56:17+00:00

COMEDI_II_PCI20KC needs HAS_IOMEM, so depend on it. The related error (
with allmodconfig under um):

    CC [M]  drivers/staging/comedi/drivers/ii_pci20kc.o
  drivers/staging/comedi/drivers/ii_pci20kc.c: In function ‘ii20k_attach’:
  drivers/staging/comedi/drivers/ii_pci20kc.c:442:2: error: implicit declaration of function ‘ioremap’ [-Werror=implicit-function-declaration]
    dev->mmio = ioremap(membase, II20K_SIZE);
    ^
  drivers/staging/comedi/drivers/ii_pci20kc.c:442:12: warning: assignment makes pointer from integer without a cast [enabled by default]
    dev->mmio = ioremap(membase, II20K_SIZE);
              ^
  drivers/staging/comedi/drivers/ii_pci20kc.c: In function ‘ii20k_detach’:
  drivers/staging/comedi/drivers/ii_pci20kc.c:512:3: error: implicit declaration of function ‘iounmap’ [-Werror=implicit-function-declaration]
     iounmap(dev->mmio);
     ^

Signed-off-by: Chen Gang 
Reviewed-by: H Hartley Sweeten 
Reviewed-by: Ian Abbott 
Signed-off-by: Greg Kroah-Hartman

staging: comedi: (regression) channel list must be set for COMEDI_CMD ioctl

2014-10-20T02:56:17+00:00

`do_cmd_ioctl()`, the handler for the `COMEDI_CMD` ioctl can incorrectly
call the Comedi subdevice's `do_cmd()` handler with a NULL channel list
pointer.  This is a regression as the `do_cmd()` handler has never been
expected to deal with that, leading to a kernel OOPS when it tries to
dereference it.

A NULL channel list pointer is allowed for the `COMEDI_CMDTEST` ioctl,
handled by `do_cmdtest_ioctl()` and the subdevice's `do_cmdtest()`
handler, but not for the `COMEDI_CMD` ioctl and its handlers.

Both `do_cmd_ioctl()` and `do_cmdtest_ioctl()` call
`__comedi_get_user_chanlist()` to copy the channel list from user memory
into dynamically allocated kernel memory and check it for consistency.
That function currently returns 0 if the `user_chanlist` parameter
(pointing to the channel list in user memory) is NULL.  That's fine for
`do_cmdtest_ioctl()`, but `do_cmd_ioctl()` incorrectly assumes the
kernel copy of the channel list has been set-up correctly.

Fix it by not allowing the `user_chanlist` parameter to be NULL in
`__comedi_get_user_chanlist()`, and only calling it from
`do_cmdtest_ioctl()` if the parameter is non-NULL.

Thanks to Bernd Porr for reporting the bug via an initial patch sent
privately.

Fixes: c6cd0eefb27b ("staging: comedi: comedi_fops: introduce __comedi_get_user_chanlist()")
Reported-by: Bernd Porr 
Signed-off-by: Ian Abbott 
Reviewed-by: H Hartley Sweeten 
Cc: Bernd Porr 
Cc:  # 3.15.y 3.16.y 3.17.y
Signed-off-by: Greg Kroah-Hartman

staging: comedi: ni_usb6501: add counter subdevice

2014-09-19T22:58:18+00:00

Add counter support for NI USB-6501.

The following functions are introduced:
- ni6501_counter_command()
- ni6501_cnt_insn_config()
- ni6501_cnt_insn_read()
- ni6501_cnt_insn_write()

Signed-off-by: Luca Ellero 
Reviewed-by: H Hartley Sweeten 
Signed-off-by: Greg Kroah-Hartman

staging: comedi: ni_usb6501: rename ni6501_send_command()

2014-09-19T22:58:18+00:00

Rename ni6501_send_command to ni6501_port_command

Signed-off-by: Luca Ellero 
Reviewed-by: H Hartley Sweeten 
Signed-off-by: Greg Kroah-Hartman

staging: comedi: ni_usb6501: remove empty lines

2014-09-19T22:58:18+00:00

ni6501_send_command(): remove empty lines in case statements

Signed-off-by: Luca Ellero 
Reviewed-by: H Hartley Sweeten 
Signed-off-by: Greg Kroah-Hartman

staging: comedi: ni_usb6501: remove useless check

2014-09-19T22:58:18+00:00

Remove useless test in ni6501_send_command. The check is useless since this
function is called only in this driver.

Signed-off-by: Luca Ellero 
Reviewed-by: H Hartley Sweeten 
Signed-off-by: Greg Kroah-Hartman

staging: comedi: ni_usb6501: replace spaces with tabs

2014-09-19T22:58:18+00:00

ni6501_auto_attach(): replace spaces with tabs to get proper alignment

Signed-off-by: Luca Ellero 
Reviewed-by: H Hartley Sweeten 
Signed-off-by: Greg Kroah-Hartman