linux-stable.git/drivers/staging/comedi, branch v3.2.32

staging: comedi: jr3_pci: fix iomem dereference

2012-10-17T02:49:10+00:00

commit e1878957b4676a17cf398f7f5723b365e9a2ca48 upstream.

Correct a direct dereference of I/O memory to use an appropriate I/O
memory access function.  Note that the pointer being dereferenced is not
currently tagged with `__iomem` but I plan to correct that for 3.7.

Signed-off-by: Ian Abbott 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Ben Hutchings

staging: comedi: s626: don't dereference insn->data

2012-10-17T02:49:00+00:00

commit b655c2c4782ed3e2e71d2608154e295a3e860311 upstream.

`s626_enc_insn_config()` is incorrectly dereferencing `insn->data` which
is a pointer to user memory.  It should be dereferencing the separate
`data` parameter that points to a copy of the data in kernel memory.

Signed-off-by: Ian Abbott 
Reviewed-by: H Hartley Sweeten 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Ben Hutchings

staging: comedi: fix memory leak for saved channel list

2012-10-17T02:48:39+00:00

commit c8cad4c89ee3b15935c532210ae6ebb5c0a2734d upstream.

When `do_cmd_ioctl()` allocates memory for the kernel copy of a channel
list, it frees any previously allocated channel list in
`async->cmd.chanlist` and replaces it with the new one.  However, if the
device is ever removed (or "detached") the cleanup code in
`cleanup_device()` in "drivers.c" does not free this memory so it is
lost.

A sensible place to free the kernel copy of the channel list is in
`do_become_nonbusy()` as at that point the comedi asynchronous command
associated with the channel list is no longer valid.  Free the channel
list in `do_become_nonbusy()` instead of `do_cmd_ioctl()` and clear the
pointer to prevent it being freed more than once.

Note that `cleanup_device()` could be called at an inappropriate time
while the comedi device is open, but that's a separate bug not related
to this this patch.

Signed-off-by: Ian Abbott 
Signed-off-by: Greg Kroah-Hartman 
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings

staging: comedi: don't dereference user memory for INSN_INTTRIG

2012-10-17T02:48:36+00:00

commit 5d06e3df280bd230e2eadc16372e62818c63e894 upstream.

`parse_insn()` is dereferencing the user-space pointer `insn->data`
directly when handling the `INSN_INTTRIG` comedi instruction.  It
shouldn't be using `insn->data` at all; it should be using the separate
`data` pointer passed to the function.  Fix it.

Signed-off-by: Ian Abbott 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Ben Hutchings

staging: comedi: das08: Correct AO output for das08jr-16-ao

2012-09-19T14:05:07+00:00

commit 61ed59ed09e6ad2b8395178ea5ad5f653bba08e3 upstream.

Don't zero out bits 15..12 of the data value in `das08jr_ao_winsn()` as
that knobbles the upper three-quarters of the output range for the
'das08jr-16-ao' board.

Signed-off-by: Ian Abbott 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Ben Hutchings

staging: comedi: das08: Correct AI encoding for das08jr-16-ao

2012-09-19T14:05:07+00:00

commit e6391a182865efc896cb2a8d79e07b7ac2f45b48 upstream.

The element of `das08_boards[]` for the 'das08jr-16-ao' board has the
`ai_encoding` member set to `das08_encode12`.  It should be set to
`das08_encode16` same as the 'das08jr/16' board.  After all, this board
has 16-bit AI resolution.

The description of the A/D LSB register at offset 0 seems incorrect in
the user manual "cio-das08jr-16-ao.pdf" as it implies that the AI
resolution is only 12 bits.  The diagrams of the A/D LSB and MSB
registers show 15 data bits and a sign bit, which matches what the
software expects for the `das08_encode16` AI encoding method.

Signed-off-by: Ian Abbott 
Signed-off-by: Greg Kroah-Hartman 
[bwh: Backported to 3.2: adjust indentation]
Signed-off-by: Ben Hutchings

drivers/staging/comedi/comedi_fops.c: add missing vfree

2012-05-30T23:43:31+00:00

commit abae41e6438b798e046d721b6ccdd55b4a398170 upstream.

aux_free is freed on all other exits from the function.  By removing the
return, we can benefit from the vfree already at the end of the function.

Signed-off-by: Julia Lawall 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Ben Hutchings

Staging: comedi: fix integer overflow in do_insnlist_ioctl()

2011-11-27T19:38:45+00:00

There is a potential integer overflow in do_insnlist_ioctl() if
userspace passes in a large insnlist.n_insns.  The call to kmalloc()
would allocate a small buffer, leading to a memory corruption.

The bug was reported by Dan Carpenter 
and Haogang Chen .  The patch was suggested by
Ian Abbott  and Lars-Peter Clausen .

Reported-by: Dan Carpenter 
Reported-by: Haogang Chen .
Cc: Ian Abbott 
Cc: Lars-Peter Clausen 
Signed-off-by: Xi Wang 
Signed-off-by: Greg Kroah-Hartman

Revert "Staging: comedi: integer overflow in do_insnlist_ioctl()"

2011-11-27T19:36:10+00:00

This reverts commit e384a41141949843899affcf51f4e6e646c1fe9f.
It's not the correct way to solve this issue.

Acked-by: Dan Carpenter 
Signed-off-by: Greg Kroah-Hartman

Staging: comedi: integer overflow in do_insnlist_ioctl()

2011-11-27T02:34:15+00:00

There is an integer overflow here that could cause memory corruption
on 32 bit systems.

insnlist.n_insns could be a very high value size calculation for
kmalloc() could overflow resulting in a smaller "insns" than
expected.  In the for (i = 0; i < insnlist.n_insns; i++) {... loop
we would read past the end of the buffer, possibly corrupting memory
as well.

Signed-off-by: Dan Carpenter 
Signed-off-by: Greg Kroah-Hartman