Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f9143eae authored by Linus Torvalds's avatar Linus Torvalds
Browse files
* 'staging-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
  Staging: comedi: fix integer overflow in do_insnlist_ioctl()
  Revert "Staging: comedi: integer overflow in do_insnlist_ioctl()"
  Staging: comedi: integer overflow in do_insnlist_ioctl()
  Staging: comedi: fix signal handling in read and write
  Staging: comedi: fix mmap_count
  staging: comedi: fix oops for USB DAQ devices.
  staging: comedi: usbduxsigma: Fixed wrong range for the analogue channel.
  staging:rts_pstor:Complete scanning_done variable
  staging: usbip: bugfix for deadlock
parents ffb8fb54 dfd8ee92
Loading
Loading
Loading
Loading
+73 −23
Original line number Original line Diff line number Diff line
@@ -671,7 +671,7 @@ static int do_insnlist_ioctl(struct comedi_device *dev,
	}
	}


	insns =
	insns =
	    kmalloc(sizeof(struct comedi_insn) * insnlist.n_insns, GFP_KERNEL);
	    kcalloc(insnlist.n_insns, sizeof(struct comedi_insn), GFP_KERNEL);
	if (!insns) {
	if (!insns) {
		DPRINTK("kmalloc failed\n");
		DPRINTK("kmalloc failed\n");
		ret = -ENOMEM;
		ret = -ENOMEM;
@@ -1432,7 +1432,21 @@ static int do_cancel(struct comedi_device *dev, struct comedi_subdevice *s)
	return ret;
	return ret;
}
}


static void comedi_unmap(struct vm_area_struct *area)

static void comedi_vm_open(struct vm_area_struct *area)
{
	struct comedi_async *async;
	struct comedi_device *dev;

	async = area->vm_private_data;
	dev = async->subdevice->device;

	mutex_lock(&dev->mutex);
	async->mmap_count++;
	mutex_unlock(&dev->mutex);
}

static void comedi_vm_close(struct vm_area_struct *area)
{
{
	struct comedi_async *async;
	struct comedi_async *async;
	struct comedi_device *dev;
	struct comedi_device *dev;
@@ -1446,15 +1460,13 @@ static void comedi_unmap(struct vm_area_struct *area)
}
}


static struct vm_operations_struct comedi_vm_ops = {
static struct vm_operations_struct comedi_vm_ops = {
	.close = comedi_unmap,
	.open = comedi_vm_open,
	.close = comedi_vm_close,
};
};


static int comedi_mmap(struct file *file, struct vm_area_struct *vma)
static int comedi_mmap(struct file *file, struct vm_area_struct *vma)
{
{
	const unsigned minor = iminor(file->f_dentry->d_inode);
	const unsigned minor = iminor(file->f_dentry->d_inode);
	struct comedi_device_file_info *dev_file_info =
	    comedi_get_device_file_info(minor);
	struct comedi_device *dev = dev_file_info->device;
	struct comedi_async *async = NULL;
	struct comedi_async *async = NULL;
	unsigned long start = vma->vm_start;
	unsigned long start = vma->vm_start;
	unsigned long size;
	unsigned long size;
@@ -1462,6 +1474,15 @@ static int comedi_mmap(struct file *file, struct vm_area_struct *vma)
	int i;
	int i;
	int retval;
	int retval;
	struct comedi_subdevice *s;
	struct comedi_subdevice *s;
	struct comedi_device_file_info *dev_file_info;
	struct comedi_device *dev;

	dev_file_info = comedi_get_device_file_info(minor);
	if (dev_file_info == NULL)
	        return -ENODEV;
	dev = dev_file_info->device;
	if (dev == NULL)
	        return -ENODEV;


	mutex_lock(&dev->mutex);
	mutex_lock(&dev->mutex);
	if (!dev->attached) {
	if (!dev->attached) {
@@ -1528,11 +1549,17 @@ static unsigned int comedi_poll(struct file *file, poll_table * wait)
{
{
	unsigned int mask = 0;
	unsigned int mask = 0;
	const unsigned minor = iminor(file->f_dentry->d_inode);
	const unsigned minor = iminor(file->f_dentry->d_inode);
	struct comedi_device_file_info *dev_file_info =
	    comedi_get_device_file_info(minor);
	struct comedi_device *dev = dev_file_info->device;
	struct comedi_subdevice *read_subdev;
	struct comedi_subdevice *read_subdev;
	struct comedi_subdevice *write_subdev;
	struct comedi_subdevice *write_subdev;
	struct comedi_device_file_info *dev_file_info;
	struct comedi_device *dev;
	dev_file_info = comedi_get_device_file_info(minor);

	if (dev_file_info == NULL)
	        return -ENODEV;
	dev = dev_file_info->device;
	if (dev == NULL)
	        return -ENODEV;


	mutex_lock(&dev->mutex);
	mutex_lock(&dev->mutex);
	if (!dev->attached) {
	if (!dev->attached) {
@@ -1578,9 +1605,15 @@ static ssize_t comedi_write(struct file *file, const char __user *buf,
	int n, m, count = 0, retval = 0;
	int n, m, count = 0, retval = 0;
	DECLARE_WAITQUEUE(wait, current);
	DECLARE_WAITQUEUE(wait, current);
	const unsigned minor = iminor(file->f_dentry->d_inode);
	const unsigned minor = iminor(file->f_dentry->d_inode);
	struct comedi_device_file_info *dev_file_info =
	struct comedi_device_file_info *dev_file_info;
	    comedi_get_device_file_info(minor);
	struct comedi_device *dev;
	struct comedi_device *dev = dev_file_info->device;
	dev_file_info = comedi_get_device_file_info(minor);

	if (dev_file_info == NULL)
	        return -ENODEV;
	dev = dev_file_info->device;
	if (dev == NULL)
	        return -ENODEV;


	if (!dev->attached) {
	if (!dev->attached) {
		DPRINTK("no driver configured on comedi%i\n", dev->minor);
		DPRINTK("no driver configured on comedi%i\n", dev->minor);
@@ -1640,11 +1673,11 @@ static ssize_t comedi_write(struct file *file, const char __user *buf,
				retval = -EAGAIN;
				retval = -EAGAIN;
				break;
				break;
			}
			}
			schedule();
			if (signal_pending(current)) {
			if (signal_pending(current)) {
				retval = -ERESTARTSYS;
				retval = -ERESTARTSYS;
				break;
				break;
			}
			}
			schedule();
			if (!s->busy)
			if (!s->busy)
				break;
				break;
			if (s->busy != file) {
			if (s->busy != file) {
@@ -1683,9 +1716,15 @@ static ssize_t comedi_read(struct file *file, char __user *buf, size_t nbytes,
	int n, m, count = 0, retval = 0;
	int n, m, count = 0, retval = 0;
	DECLARE_WAITQUEUE(wait, current);
	DECLARE_WAITQUEUE(wait, current);
	const unsigned minor = iminor(file->f_dentry->d_inode);
	const unsigned minor = iminor(file->f_dentry->d_inode);
	struct comedi_device_file_info *dev_file_info =
	struct comedi_device_file_info *dev_file_info;
	    comedi_get_device_file_info(minor);
	struct comedi_device *dev;
	struct comedi_device *dev = dev_file_info->device;
	dev_file_info = comedi_get_device_file_info(minor);

	if (dev_file_info == NULL)
	        return -ENODEV;
	dev = dev_file_info->device;
	if (dev == NULL)
	        return -ENODEV;


	if (!dev->attached) {
	if (!dev->attached) {
		DPRINTK("no driver configured on comedi%i\n", dev->minor);
		DPRINTK("no driver configured on comedi%i\n", dev->minor);
@@ -1741,11 +1780,11 @@ static ssize_t comedi_read(struct file *file, char __user *buf, size_t nbytes,
				retval = -EAGAIN;
				retval = -EAGAIN;
				break;
				break;
			}
			}
			schedule();
			if (signal_pending(current)) {
			if (signal_pending(current)) {
				retval = -ERESTARTSYS;
				retval = -ERESTARTSYS;
				break;
				break;
			}
			}
			schedule();
			if (!s->busy) {
			if (!s->busy) {
				retval = 0;
				retval = 0;
				break;
				break;
@@ -1885,11 +1924,17 @@ ok:
static int comedi_close(struct inode *inode, struct file *file)
static int comedi_close(struct inode *inode, struct file *file)
{
{
	const unsigned minor = iminor(inode);
	const unsigned minor = iminor(inode);
	struct comedi_device_file_info *dev_file_info =
	    comedi_get_device_file_info(minor);
	struct comedi_device *dev = dev_file_info->device;
	struct comedi_subdevice *s = NULL;
	struct comedi_subdevice *s = NULL;
	int i;
	int i;
	struct comedi_device_file_info *dev_file_info;
	struct comedi_device *dev;
	dev_file_info = comedi_get_device_file_info(minor);

	if (dev_file_info == NULL)
	        return -ENODEV;
	dev = dev_file_info->device;
	if (dev == NULL)
	        return -ENODEV;


	mutex_lock(&dev->mutex);
	mutex_lock(&dev->mutex);


@@ -1923,10 +1968,15 @@ static int comedi_close(struct inode *inode, struct file *file)
static int comedi_fasync(int fd, struct file *file, int on)
static int comedi_fasync(int fd, struct file *file, int on)
{
{
	const unsigned minor = iminor(file->f_dentry->d_inode);
	const unsigned minor = iminor(file->f_dentry->d_inode);
	struct comedi_device_file_info *dev_file_info =
	struct comedi_device_file_info *dev_file_info;
	    comedi_get_device_file_info(minor);
	struct comedi_device *dev;
	dev_file_info = comedi_get_device_file_info(minor);


	struct comedi_device *dev = dev_file_info->device;
	if (dev_file_info == NULL)
	        return -ENODEV;
	dev = dev_file_info->device;
	if (dev == NULL)
	        return -ENODEV;


	return fasync_helper(fd, file, on, &dev->async_queue);
	return fasync_helper(fd, file, on, &dev->async_queue);
}
}
+4 −3
Original line number Original line Diff line number Diff line
#define DRIVER_VERSION "v0.5"
#define DRIVER_VERSION "v0.6"
#define DRIVER_AUTHOR "Bernd Porr, BerndPorr@f2s.com"
#define DRIVER_AUTHOR "Bernd Porr, BerndPorr@f2s.com"
#define DRIVER_DESC "Stirling/ITL USB-DUX SIGMA -- Bernd.Porr@f2s.com"
#define DRIVER_DESC "Stirling/ITL USB-DUX SIGMA -- Bernd.Porr@f2s.com"
/*
/*
@@ -25,7 +25,7 @@ Driver: usbduxsigma
Description: University of Stirling USB DAQ & INCITE Technology Limited
Description: University of Stirling USB DAQ & INCITE Technology Limited
Devices: [ITL] USB-DUX (usbduxsigma.o)
Devices: [ITL] USB-DUX (usbduxsigma.o)
Author: Bernd Porr <BerndPorr@f2s.com>
Author: Bernd Porr <BerndPorr@f2s.com>
Updated: 21 Jul 2011
Updated: 8 Nov 2011
Status: testing
Status: testing
*/
*/
/*
/*
@@ -44,6 +44,7 @@ Status: testing
 *   0.3: proper vendor ID and driver name
 *   0.3: proper vendor ID and driver name
 *   0.4: fixed D/A voltage range
 *   0.4: fixed D/A voltage range
 *   0.5: various bug fixes, health check at startup
 *   0.5: various bug fixes, health check at startup
 *   0.6: corrected wrong input range
 */
 */


/* generates loads of debug info */
/* generates loads of debug info */
@@ -175,7 +176,7 @@ Status: testing
/* comedi constants */
/* comedi constants */
static const struct comedi_lrange range_usbdux_ai_range = { 1, {
static const struct comedi_lrange range_usbdux_ai_range = { 1, {
								BIP_RANGE
								BIP_RANGE
								(2.65)
								(2.65/2.0)
								}
								}
};
};


+1 −0
Original line number Original line Diff line number Diff line
@@ -1021,6 +1021,7 @@ static int __devinit rtsx_probe(struct pci_dev *pci,
	th = kthread_create(rtsx_scan_thread, dev, "rtsx-scan");
	th = kthread_create(rtsx_scan_thread, dev, "rtsx-scan");
	if (IS_ERR(th)) {
	if (IS_ERR(th)) {
		printk(KERN_ERR "Unable to start the device-scanning thread\n");
		printk(KERN_ERR "Unable to start the device-scanning thread\n");
		complete(&dev->scanning_done);
		quiesce_and_remove_host(dev);
		quiesce_and_remove_host(dev);
		err = PTR_ERR(th);
		err = PTR_ERR(th);
		goto errout;
		goto errout;
+6 −4
Original line number Original line Diff line number Diff line
@@ -68,6 +68,7 @@ static void vhci_recv_ret_submit(struct vhci_device *vdev,
{
{
	struct usbip_device *ud = &vdev->ud;
	struct usbip_device *ud = &vdev->ud;
	struct urb *urb;
	struct urb *urb;
	unsigned long flags;


	spin_lock(&vdev->priv_lock);
	spin_lock(&vdev->priv_lock);
	urb = pickup_urb_and_free_priv(vdev, pdu->base.seqnum);
	urb = pickup_urb_and_free_priv(vdev, pdu->base.seqnum);
@@ -101,9 +102,9 @@ static void vhci_recv_ret_submit(struct vhci_device *vdev,


	usbip_dbg_vhci_rx("now giveback urb %p\n", urb);
	usbip_dbg_vhci_rx("now giveback urb %p\n", urb);


	spin_lock(&the_controller->lock);
	spin_lock_irqsave(&the_controller->lock, flags);
	usb_hcd_unlink_urb_from_ep(vhci_to_hcd(the_controller), urb);
	usb_hcd_unlink_urb_from_ep(vhci_to_hcd(the_controller), urb);
	spin_unlock(&the_controller->lock);
	spin_unlock_irqrestore(&the_controller->lock, flags);


	usb_hcd_giveback_urb(vhci_to_hcd(the_controller), urb, urb->status);
	usb_hcd_giveback_urb(vhci_to_hcd(the_controller), urb, urb->status);


@@ -141,6 +142,7 @@ static void vhci_recv_ret_unlink(struct vhci_device *vdev,
{
{
	struct vhci_unlink *unlink;
	struct vhci_unlink *unlink;
	struct urb *urb;
	struct urb *urb;
	unsigned long flags;


	usbip_dump_header(pdu);
	usbip_dump_header(pdu);


@@ -170,9 +172,9 @@ static void vhci_recv_ret_unlink(struct vhci_device *vdev,
		urb->status = pdu->u.ret_unlink.status;
		urb->status = pdu->u.ret_unlink.status;
		pr_info("urb->status %d\n", urb->status);
		pr_info("urb->status %d\n", urb->status);


		spin_lock(&the_controller->lock);
		spin_lock_irqsave(&the_controller->lock, flags);
		usb_hcd_unlink_urb_from_ep(vhci_to_hcd(the_controller), urb);
		usb_hcd_unlink_urb_from_ep(vhci_to_hcd(the_controller), urb);
		spin_unlock(&the_controller->lock);
		spin_unlock_irqrestore(&the_controller->lock, flags);


		usb_hcd_giveback_urb(vhci_to_hcd(the_controller), urb,
		usb_hcd_giveback_urb(vhci_to_hcd(the_controller), urb,
				     urb->status);
				     urb->status);