linux-stable.git/drivers/staging/comedi, branch v3.2.28

drivers/staging/comedi/comedi_fops.c: add missing vfree

2012-05-30T23:43:31+00:00

commit abae41e6438b798e046d721b6ccdd55b4a398170 upstream.

aux_free is freed on all other exits from the function.  By removing the
return, we can benefit from the vfree already at the end of the function.

Signed-off-by: Julia Lawall 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Ben Hutchings

Staging: comedi: fix integer overflow in do_insnlist_ioctl()

2011-11-27T19:38:45+00:00

There is a potential integer overflow in do_insnlist_ioctl() if
userspace passes in a large insnlist.n_insns.  The call to kmalloc()
would allocate a small buffer, leading to a memory corruption.

The bug was reported by Dan Carpenter 
and Haogang Chen .  The patch was suggested by
Ian Abbott  and Lars-Peter Clausen .

Reported-by: Dan Carpenter 
Reported-by: Haogang Chen .
Cc: Ian Abbott 
Cc: Lars-Peter Clausen 
Signed-off-by: Xi Wang 
Signed-off-by: Greg Kroah-Hartman

Revert "Staging: comedi: integer overflow in do_insnlist_ioctl()"

2011-11-27T19:36:10+00:00

This reverts commit e384a41141949843899affcf51f4e6e646c1fe9f.
It's not the correct way to solve this issue.

Acked-by: Dan Carpenter 
Signed-off-by: Greg Kroah-Hartman

Staging: comedi: integer overflow in do_insnlist_ioctl()

2011-11-27T02:34:15+00:00

There is an integer overflow here that could cause memory corruption
on 32 bit systems.

insnlist.n_insns could be a very high value size calculation for
kmalloc() could overflow resulting in a smaller "insns" than
expected.  In the for (i = 0; i < insnlist.n_insns; i++) {... loop
we would read past the end of the buffer, possibly corrupting memory
as well.

Signed-off-by: Dan Carpenter 
Signed-off-by: Greg Kroah-Hartman

Staging: comedi: fix signal handling in read and write

2011-11-27T02:34:15+00:00

After sleeping on a wait queue, signal_pending(current) should be
checked (not before sleeping).

Acked-by: Alessandro Rubini 
Signed-off-by: Federico Vaga 
Cc: stable 
Signed-off-by: Greg Kroah-Hartman

Staging: comedi: fix mmap_count

2011-11-27T02:34:14+00:00

In comedi_fops, mmap_count is decremented at comedi_vm_ops->close but
it is not incremented at comedi_vm_ops->open. This may result in a negative
counter.  The patch introduces the open method to keep the counter
consistent.

The bug was triggerd by this sample code:

        mmap(0, ...., comedi_fd);
        fork();
        exit(0);

Acked-by: Alessandro Rubini 
Signed-off-by: Federico Vaga 
Cc: stable 
Signed-off-by: Greg Kroah-Hartman

staging: comedi: fix oops for USB DAQ devices.

2011-11-27T02:34:14+00:00

This fixes kernel oops when an USB DAQ device is plugged out while it's
communicating with the userspace software.

Signed-off-by: Bernd Porr 
Cc: stable 
Signed-off-by: Greg Kroah-Hartman

staging: comedi: usbduxsigma: Fixed wrong range for the analogue channel.

2011-11-27T02:34:14+00:00

It's actually +/-2.65V/2 and not +/-2.65V.

Signed-off-by: Bernd Porr 
Cc: stable 
Signed-off-by: Greg Kroah-Hartman

Staging: comedi: fix brace coding style issue in ni_atmio.c

2011-10-17T22:11:30+00:00

This is a patch to the ni_atmio.c file which fixes a brace and whitespace warning found by the checkpatch.pl tool

Signed-off-by: Jake Burton 
Signed-off-by: Greg Kroah-Hartman

Staging: comedi: c6xdigio: fixed missing KERN_* in printk

2011-10-17T22:11:30+00:00

Fixed missing KERN_* in printk statements.

Signed-off-by: Nasir Abed 
Signed-off-by: Greg Kroah-Hartman