Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f19e6c69 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'staging-3.11-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging 

Pull staging fixes from Greg KH:
 "Here are some tiny drivers/staging/ fixes for 3.11-rc3

  A number of bugfixes, all pretty tiny, but resolve issues that have
  been reported (the kstrtos32 change fixes a data corruption problem
  that Dan found).  And a MAINTAINERS file update for the comedi
  drivers"

* tag 'staging-3.11-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
  MAINTAINERS: Update the list of maintainers for staging/comedi driver.
  staging: tidspbridge: replace strict_strtol() with kstrtos32()
  staging: android: logger: Correct write offset reset on error
  staging: zram: protect zram_reset_device() call
  staging: gdm72xx: potential use after free in send_qos_list()
  staging: drm/imx: drop "select OF_VIDEOMODE"
  staging: frontier: use after free in disconnect()
  staging: comedi: fix a race between do_cmd_ioctl() and read/write
  staging: comedi: COMEDI_CANCEL ioctl should wake up read/write
parents 05e4cb7c 81b884c9

MAINTAINERS

+1 −1
Original line number Diff line number Diff line
@@ -7818,7 +7818,7 @@ F: drivers/staging/asus_oled/ 


STAGING - COMEDI

M:	Ian Abbott <abbotti@mev.co.uk>

M:	Mori Hess <fmhess@users.sourceforge.net>

M:	H Hartley Sweeten <hsweeten@visionengravers.com>

S:	Odd Fixes

F:	drivers/staging/comedi/

drivers/staging/android/logger.c

+3 −1
Original line number Diff line number Diff line
@@ -469,7 +469,7 @@ static ssize_t logger_aio_write(struct kiocb *iocb, const struct iovec *iov, 
			 unsigned long nr_segs, loff_t ppos)

{

	struct logger_log *log = file_get_log(iocb->ki_filp);

	size_t orig = log->w_off;

	size_t orig;

	struct logger_entry header;

	struct timespec now;

	ssize_t ret = 0;
@@ -490,6 +490,8 @@ static ssize_t logger_aio_write(struct kiocb *iocb, const struct iovec *iov, 


	mutex_lock(&log->mutex);



	orig = log->w_off;



	/*

	 * Fix up any readers, pulling them forward to the first readable

	 * entry after (what will be) the new write offset. We do this now

drivers/staging/comedi/TODO

+1 −1
Original line number Diff line number Diff line
@@ -9,4 +9,4 @@ TODO: 
Please send patches to Greg Kroah-Hartman <greg@kroah.com> and

copy:

	Ian Abbott <abbotti@mev.co.uk>

	Frank Mori Hess <fmhess@users.sourceforge.net>
 
	H Hartley Sweeten <hsweeten@visionengravers.com>

drivers/staging/comedi/comedi_fops.c

+21 −11
Original line number Diff line number Diff line
@@ -1413,22 +1413,19 @@ static int do_cmd_ioctl(struct comedi_device *dev, 
		DPRINTK("subdevice busy\n");

		return -EBUSY;

	}

	s->busy = file;



	/* make sure channel/gain list isn't too long */

	if (cmd.chanlist_len > s->len_chanlist) {

		DPRINTK("channel/gain list too long %u > %d\n",

			cmd.chanlist_len, s->len_chanlist);

		ret = -EINVAL;

		goto cleanup;

		return -EINVAL;

	}



	/* make sure channel/gain list isn't too short */

	if (cmd.chanlist_len < 1) {

		DPRINTK("channel/gain list too short %u < 1\n",

			cmd.chanlist_len);

		ret = -EINVAL;

		goto cleanup;

		return -EINVAL;

	}



	async->cmd = cmd;
@@ -1438,8 +1435,7 @@ static int do_cmd_ioctl(struct comedi_device *dev, 
	    kmalloc(async->cmd.chanlist_len * sizeof(int), GFP_KERNEL);

	if (!async->cmd.chanlist) {

		DPRINTK("allocation failed\n");

		ret = -ENOMEM;

		goto cleanup;

		return -ENOMEM;

	}



	if (copy_from_user(async->cmd.chanlist, user_chanlist,
@@ -1491,6 +1487,9 @@ static int do_cmd_ioctl(struct comedi_device *dev, 


	comedi_set_subdevice_runflags(s, ~0, SRF_USER | SRF_RUNNING);



	/* set s->busy _after_ setting SRF_RUNNING flag to avoid race with

	 * comedi_read() or comedi_write() */

	s->busy = file;

	ret = s->do_cmd(dev, s);

	if (ret == 0)

		return 0;
@@ -1705,6 +1704,7 @@ static int do_cancel_ioctl(struct comedi_device *dev, unsigned int arg, 
			   void *file)

{

	struct comedi_subdevice *s;

	int ret;



	if (arg >= dev->n_subdevices)

		return -EINVAL;
@@ -1721,7 +1721,11 @@ static int do_cancel_ioctl(struct comedi_device *dev, unsigned int arg, 
	if (s->busy != file)

		return -EBUSY;



	return do_cancel(dev, s);

	ret = do_cancel(dev, s);

	if (comedi_get_subdevice_runflags(s) & SRF_USER)

		wake_up_interruptible(&s->async->wait_head);



	return ret;

}



/*
@@ -2053,11 +2057,13 @@ static ssize_t comedi_write(struct file *file, const char __user *buf, 


		if (!comedi_is_subdevice_running(s)) {

			if (count == 0) {

				mutex_lock(&dev->mutex);

				if (comedi_is_subdevice_in_error(s))

					retval = -EPIPE;

				else

					retval = 0;

				do_become_nonbusy(dev, s);

				mutex_unlock(&dev->mutex);

			}

			break;

		}
@@ -2156,11 +2162,13 @@ static ssize_t comedi_read(struct file *file, char __user *buf, size_t nbytes, 


		if (n == 0) {

			if (!comedi_is_subdevice_running(s)) {

				mutex_lock(&dev->mutex);

				do_become_nonbusy(dev, s);

				if (comedi_is_subdevice_in_error(s))

					retval = -EPIPE;

				else

					retval = 0;

				mutex_unlock(&dev->mutex);

				break;

			}

			if (file->f_flags & O_NONBLOCK) {
@@ -2198,9 +2206,11 @@ static ssize_t comedi_read(struct file *file, char __user *buf, size_t nbytes, 
		buf += n;

		break;		/* makes device work like a pipe */

	}

	if (comedi_is_subdevice_idle(s) &&

	    async->buf_read_count - async->buf_write_count == 0) {

	if (comedi_is_subdevice_idle(s)) {

		mutex_lock(&dev->mutex);

		if (async->buf_read_count - async->buf_write_count == 0)

			do_become_nonbusy(dev, s);

		mutex_unlock(&dev->mutex);

	}

	set_current_state(TASK_RUNNING);

	remove_wait_queue(&async->wait_head, &wait);

drivers/staging/frontier/alphatrack.c

+1 −1
Original line number Diff line number Diff line
@@ -827,11 +827,11 @@ static void usb_alphatrack_disconnect(struct usb_interface *intf) 
		mutex_unlock(&dev->mtx);

		usb_alphatrack_delete(dev);

	} else {

		atomic_set(&dev->writes_pending, 0);

		dev->intf = NULL;

		mutex_unlock(&dev->mtx);

	}



	atomic_set(&dev->writes_pending, 0);

	mutex_unlock(&disconnect_mutex);



	dev_info(&intf->dev, "Alphatrack Surface #%d now disconnected\n",