linux-stable.git/drivers/staging, branch v4.1.38

staging: comedi: ni_mio_common: fix M Series ni_ai_insn_read() data mask

2017-01-13T01:56:53+00:00

[ Upstream commit 655c4d442d1213b617926cc6d54e2a9a793fb46b ]

For NI M Series cards, the Comedi `insn_read` handler for the AI
subdevice is broken due to ANDing the value read from the AI FIFO data
register with an incorrect mask.  The incorrect mask clears all but the
most significant bit of the sample data.  It should preserve all the
sample data bits.  Correct it.

Fixes: 817144ae7fda ("staging: comedi: ni_mio_common: remove unnecessary use of 'board->adbits'")
Signed-off-by: Ian Abbott 
Cc: 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin

fs: Give dentry to inode_change_ok() instead of inode

2016-12-23T13:56:35+00:00

[ Upstream commit 31051c85b5e2aaaf6315f74c72a732673632a905 ]

inode_change_ok() will be resposible for clearing capabilities and IMA
extended attributes and as such will need dentry. Give it as an argument
to inode_change_ok() instead of an inode. Also rename inode_change_ok()
to setattr_prepare() to better relect that it does also some
modifications in addition to checks.

References: CVE-2015-1350
Reviewed-by: Christoph Hellwig 
Signed-off-by: Jan Kara 
Signed-off-by: Philipp Hahn 
Signed-off-by: Sasha Levin

staging: comedi: ni_mio_common: fix AO inttrig backwards compatibility

2016-09-12T13:45:00+00:00

[ Upstream commit f0f4b0cc3a8cffd983f5940d46cd0227f3f5710a ]

Commit ebb657babfa9 ("staging: comedi: ni_mio_common: clarify the
cmd->start_arg validation and use") introduced a backwards compatibility
issue in the use of asynchronous commands on the AO subdevice when
`start_src` is `TRIG_EXT`.  Valid values for `start_src` are `TRIG_INT`
(for internal, software trigger), and `TRIG_EXT` (for external trigger).
When set to `TRIG_EXT`.  In both cases, the driver relies on an
internal, software trigger to set things up (allowing the user
application to write sufficient samples to the data buffer before the
trigger), so it acts as a software "pre-trigger" in the `TRIG_EXT` case.
The software trigger is handled by `ni_ao_inttrig()`.

Prior to the above change, when `start_src` was `TRIG_INT`, `start_arg`
was required to be 0, and `ni_ao_inttrig()` checked that the software
trigger number was also 0.  After the above change, when `start_src` was
`TRIG_INT`, any value was allowed for `start_arg`, and `ni_ao_inttrig()`
checked that the software trigger number matched this `start_arg` value.
The backwards compatibility issue is that the internal trigger number
now has to match `start_arg` when `start_src` is `TRIG_EXT` when it
previously had to be 0.

Fix the backwards compatibility issue in `ni_ao_inttrig()` by always
allowing software trigger number 0 when `start_src` is something other
than `TRIG_INT`.

Thanks to Spencer Olson for reporting the issue.

Signed-off-by: Ian Abbott 
Reported-by: Spencer Olson 
Fixes: ebb657babfa9 ("staging: comedi: ni_mio_common: clarify the cmd->start_arg validation and use")
Cc: stable 
Reviewed-by: H Hartley Sweeten 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin

staging: comedi: ni_mio_common: fix wrong insn_write handler

2016-09-12T13:44:54+00:00

[ Upstream commit 5ca05345c56cb979e1a25ab6146437002f95cac8 ]

For counter subdevices, the `s->insn_write` handler is being set to the
wrong function, `ni_tio_insn_read()`.  It should be
`ni_tio_insn_write()`.

Signed-off-by: Ian Abbott 
Reported-by: Éric Piel 
Fixes: 10f74377eec3 ("staging: comedi: ni_tio: make ni_tio_winsn() a
  proper comedi (*insn_write)"
Cc:  # 3.17+
Signed-off-by: Greg Kroah-Hartman 

Signed-off-by: Sasha Levin

staging: comedi: daqboard2000: bug fix board type matching code

2016-09-12T13:44:43+00:00

[ Upstream commit 80e162ee9b31d77d851b10f8c5299132be1e120f ]

`daqboard2000_find_boardinfo()` is supposed to check if the
DaqBoard/2000 series model is supported, based on the PCI subvendor and
subdevice ID.  The current code is wrong as it is comparing the PCI
device's subdevice ID to an expected, fixed value for the subvendor ID.
It should be comparing the PCI device's subvendor ID to this fixed
value.  Correct it.

Fixes: 7e8401b23e7f ("staging: comedi: daqboard2000: add back
subsystem_device check")
Signed-off-by: Ian Abbott 
Cc:  # 3.7+
Signed-off-by: Greg Kroah-Hartman 

Signed-off-by: Sasha Levin

staging: comedi: comedi_test: fix timer race conditions

2016-09-07T18:37:59+00:00

[ commit 403fe7f34e3327ddac2e06a15e76a293d613381e upstream.

  Patch is cut down a bit from upstream patch, as upstream patch fixed
  parts that don't exist in this version.  Also, some identifiers were
  renamed, so patch description has been edited accordingly
  -- Ian Abbott
]

Commit 73e0e4dfed4c ("staging: comedi: comedi_test: fix timer lock-up")
fixed a lock-up in the timer routine `waveform_ai_interrupt()` caused by
commit 240512474424 ("staging: comedi: comedi_test: use
comedi_handle_events()").  However, it introduced a race condition that
can result in the timer routine misbehaving, such as accessing freed
memory or dereferencing a NULL pointer.

73e0... changed the timer routine to do nothing unless a
`WAVEFORM_AI_RUNNING` flag was set, and changed `waveform_ai_cancel()`
to clear the flag and replace a call to `del_timer_sync()` with a call
to `del_timer()`.  `waveform_ai_cancel()` may be called from the timer
routine itself (via `comedi_handle_events()`), or from `do_cancel()`.
(`do_cancel()` is called as a result of a file operation (usually a
`COMEDI_CANCEL` ioctl command, or a release), or during device removal.)
When called from `do_cancel()`, the call to `waveform_ai_cancel()` is
followed by a call to `do_become_nonbusy()`, which frees up stuff for
the current asynchronous command under the assumption that it is now
safe to do so.  The race condition occurs when the timer routine
`waveform_ai_interrupt()` checks the `WAVEFORM_AI_RUNNING` flag just
before it is cleared by `waveform_ai_cancel()`, and is still running
during the call to `do_become_nonbusy()`.  In particular, it can lead to
a NULL pointer dereference because `do_become_nonbusy()` frees
`async->cmd.chanlist` and sets it to `NULL`, but
`waveform_ai_interrupt()` dereferences it.

Fix the race by calling `del_timer_sync()` instead of `del_timer()` in
`waveform_ai_cancel()` when not in an interrupt context.  The only time
`waveform_ai_cancel()` is called in an interrupt context is when it is
called from the timer routine itself, via `comedi_handle_events()`.

There is no longer any need for the `WAVEFORM_AI_RUNNING` flag, so get
rid of it.

Fixes: 73e0e4dfed4c ("staging: comedi: comedi_test: fix timer lock-up")
Reported-by: Éric Piel 
Signed-off-by: Ian Abbott 
Cc: Éric Piel 
Signed-off-by: Sasha Levin

staging: iio: accel: fix error check

2016-08-20T03:08:43+00:00

[ Upstream commit ef3149eb3ddb7f9125e11c90f8330e371b55cffd ]

sca3000_read_ctrl_reg() returns a negative number on failure, check for
this instead of zero.

Signed-off-by: Luis de Bethencourt 
Cc: 
Signed-off-by: Jonathan Cameron 
Signed-off-by: Sasha Levin

staging: comedi: das1800: fix possible NULL dereference

2016-06-03T23:15:36+00:00

[ Upstream commit d375278d666760e195693b57415ba0a125cadd55 ]

DMA is optional with this driver. If it was not enabled the devpriv->dma
pointer will be NULL.

Fix the possible NULL pointer dereference when trying to disable the DMA
channels in das1800_ai_cancel() and tidy up the comments to fix the
checkpatch.pl issues:
WARNING: line over 80 characters

It's probably harmless in das1800_ai_setup_dma() because the 'desc' pointer
will not be used if DMA is disabled but fix it there also.

Fixes: 99dfc3357e98 ("staging: comedi: das1800: remove depends on ISA_DMA_API limitation")
Cc:  # 4.0+
Signed-off-by: H Hartley Sweeten 
Reviewed-by: Ian Abbott 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin

staging: comedi: ni_mio_common: fix the ni_write[blw]() functions

2016-04-18T12:51:07+00:00

[ Upstream commit bd3a3cd6c27b117fb9a43a38c8072c95332beecc ]

Memory mapped io (dev->mmio) should not also be writing to the ioport
(dev->iobase) registers. Add the missing 'else' to these functions.

Fixes: 0953ee4acca0 ("staging: comedi: ni_mio_common: checkpatch.pl cleanup (else not useful)")
Cc:  # 3.17+
Signed-off-by: H Hartley Sweeten 
Reviewed-by: Ian Abbott 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin

staging: comedi: ni_tiocmd: change mistaken use of start_src for start_arg

2016-04-18T12:50:35+00:00

[ Upstream commit 1fd24a4702d2af0ea4d5845126cf57d4d1796216 ]

This fixes a bug in function ni_tio_input_inttrig().  The trigger number
should be compared to cmd->start_arg, not cmd->start_src.

Fixes: 6a760394d7eb ("staging: comedi: ni_tiocmd: clarify the cmd->start_arg validation and use")
Cc:  # 3.17+
Signed-off-by: Spencer E. Olson 
Reviewed-by: Ian Abbott 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin