linux-stable.git/drivers/staging/comedi, branch v5.0.7

staging: comedi: ni_mio_common: Fix divide-by-zero for DIO cmdtest

2019-04-03T04:27:32+00:00

commit bafd9c64056cd034a1174dcadb65cd3b294ff8f6 upstream.

`ni_cdio_cmdtest()` validates Comedi asynchronous commands for the DIO
subdevice (subdevice 2) of supported National Instruments M-series
cards.  It is called when handling the `COMEDI_CMD` and `COMEDI_CMDTEST`
ioctls for this subdevice.  There are two causes for a possible
divide-by-zero error when validating that the `stop_arg` member of the
passed-in command is not too large.

The first cause for the divide-by-zero is that calls to
`comedi_bytes_per_scan()` are only valid once the command has been
copied to `s->async->cmd`, but that copy is only done for the
`COMEDI_CMD` ioctl.  For the `COMEDI_CMDTEST` ioctl, it will use
whatever was left there by the previous `COMEDI_CMD` ioctl, if any.
(This is very likely, as it is usual for the application to use
`COMEDI_CMDTEST` before `COMEDI_CMD`.) If there has been no previous,
valid `COMEDI_CMD` for this subdevice, then `comedi_bytes_per_scan()`
will return 0, so the subsequent division in `ni_cdio_cmdtest()` of
`s->async->prealloc_bufsz / comedi_bytes_per_scan(s)` will be a
divide-by-zero error.  To fix this error, call a new function
`comedi_bytes_per_scan_cmd(s, cmd)`, based on the existing
`comedi_bytes_per_scan(s)` but using a specified `struct comedi_cmd` for
its calculations.  (Also refactor `comedi_bytes_per_scan()` to call the
new function.)

Once the first cause for the divide-by-zero has been fixed, the second
cause is that `comedi_bytes_per_scan_cmd()` can legitimately return 0 if
the `scan_end_arg` member of the `struct comedi_cmd` being tested is 0.
Fix it by only performing the division (and validating that `stop_arg`
is no more than the maximum value) if `comedi_bytes_per_scan_cmd()`
returns a non-zero value.

The problem was reported on the COMEDI mailing list here:
https://groups.google.com/forum/#!topic/comedi_list/4t9WlHzMhKM

Reported-by: Ivan Vasilyev 
Tested-by: Ivan Vasilyev 
Fixes: f164cbf98fa8 ("staging: comedi: ni_mio_common: add finite regeneration to dio output")
Cc:  # 4.6+
Cc: Spencer E. Olson 
Signed-off-by: Ian Abbott 
Signed-off-by: Greg Kroah-Hartman

staging: comedi: ni_660x: fix missing break in switch statement

2019-03-10T06:08:58+00:00

commit 479826cc86118e0d87e5cefb3df5b748e0480924 upstream.

Add missing break statement in order to prevent the code from falling
through to the default case and return -EINVAL every time.

This bug was found thanks to the ongoing efforts to enable
-Wimplicit-fallthrough.

Fixes: aa94f2888825 ("staging: comedi: ni_660x: tidy up ni_660x_set_pfi_routing()")
Cc: stable@vger.kernel.org
Signed-off-by: Gustavo A. R. Silva 
Reviewed-by: Ian Abbott 
Signed-off-by: Greg Kroah-Hartman

Remove 'type' argument from access_ok() function

2019-01-04T02:57:57+00:00

Nobody has actually used the type (VERIFY_READ vs VERIFY_WRITE) argument
of the user address range verification function since we got rid of the
old racy i386-only code to walk page tables by hand.

It existed because the original 80386 would not honor the write protect
bit when in kernel mode, so you had to do COW by hand before doing any
user access.  But we haven't supported that in a long time, and these
days the 'type' argument is a purely historical artifact.

A discussion about extending 'user_access_begin()' to do the range
checking resulted this patch, because there is no way we're going to
move the old VERIFY_xyz interface to that model.  And it's best done at
the end of the merge window when I've done most of my merges, so let's
just get this done once and for all.

This patch was mostly done with a sed-script, with manual fix-ups for
the cases that weren't of the trivial 'access_ok(VERIFY_xyz' form.

There were a couple of notable cases:

 - csky still had the old "verify_area()" name as an alias.

 - the iter_iov code had magical hardcoded knowledge of the actual
   values of VERIFY_{READ,WRITE} (not that they mattered, since nothing
   really used it)

 - microblaze used the type argument for a debug printout

but other than those oddities this should be a total no-op patch.

I tried to fix up all architectures, did fairly extensive grepping for
access_ok() uses, and the changes are trivial, but I may have missed
something.  Any missed conversion should be trivially fixable, though.

Signed-off-by: Linus Torvalds

Staging: comedi: cb_pcidas: fixed a spelling mistake coding style issue

2018-12-17T13:16:07+00:00

Fixed a coding style issue.

Signed-off-by: Amir Mahdi Ghorbanian 
Signed-off-by: Greg Kroah-Hartman

staging: comedi: change do_insn*_ioctl to allow more samples

2018-12-12T10:37:58+00:00

Changes do_insn*_ioctl functions to allow for data lengths for each
comedi_insn of up to 2^16.  This patch also changes these functions to only
allocate as much memory as is necessary for each comedi_insn, rather than
allocating a fixed-sized scratch space.

In testing some user-space code for the new INSN_DEVICE_CONFIG_GET_ROUTES
facility with some newer hardware, I discovered that do_insn_ioctl and
do_insnlist_ioctl limited the amount of data that can be passed into the
kernel for insn's to a length of 256.  For some newer hardware, the number
of routes can be greater than 1000.  Working around the old limits (256)
would complicate the user-space/kernel interaction.

The new upper limit is reasonable with current memory available and does
not otherwise impact the memory footprint for any current or otherwise
typical configuration.

Signed-off-by: Spencer E. Olson 
Reviewed-by: Ian Abbott 
Signed-off-by: Greg Kroah-Hartman

staging: comedi: drivers: Cleanup malformed licence identifier

2018-12-05T08:44:05+00:00

This patch fixes multiple occurences of the checkpatch.pl warning:
WARNING: Missing or malformed SPDX-License-Identifier tag in line 1

NB. This is an additional patch and does not overlap the patch sent
yesterday for 8255.h. Should have sent them all together.
Newb mistake.

Cc: Ian Abbott 
Cc: H Hartley Sweeten 
Signed-off-by: Stephen Davies 
Signed-off-by: Greg Kroah-Hartman

staging: comedi: fix spelling mistake "desination" -> "destination"

2018-12-05T08:39:45+00:00

There is a spelling mistake in message text in the call to unittest,
fix this.

Signed-off-by: Colin Ian King 
Reviewed-by: Ian Abbott 
Signed-off-by: Greg Kroah-Hartman

staging: comedi: drivers: Cleanup malformed license identifier

2018-12-05T08:39:45+00:00

This patch fixes the checkpatch.pl warning:
WARNING: Missing or malformed SPDX-License-Identifier tag in line 1

Cc: Ian Abbott 
Cc: H Hartley Sweeten 
Signed-off-by: Stephen Davies 
Signed-off-by: Greg Kroah-Hartman

Merge 4.20-rc5 into staging-next

2018-12-03T06:55:28+00:00

We need the staging fixes in here as well.

Signed-off-by: Greg Kroah-Hartman

staging: comedi: clarify/unify macros for NI macro-defined terminals

2018-11-07T12:08:28+00:00

Uses a single macro to define multiple macros that represent a series of
terminals for NI devices.  This patch also redefines NI_MAX_COUNTERS as the
maximum number of counters possible on NI devices (instead of the maximum
index of the counters).  This was a little confusing and caused a bug in
commit 347e244884c3b ("staging: comedi: tio: implement global tio/ctr routing")
when setting/reading registers for counter terminals.

Fixes: 347e244884c3b ("staging: comedi: tio: implement global tio/ctr routing")
Signed-off-by: Spencer E. Olson 
Reviewed-by: Ian Abbott 
Signed-off-by: Greg Kroah-Hartman