Skip to content

Commit f9143ea

Browse files
torvaldstorvalds
committed
Merge branch 'staging-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging
* 'staging-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: Staging: comedi: fix integer overflow in do_insnlist_ioctl() Revert "Staging: comedi: integer overflow in do_insnlist_ioctl()" Staging: comedi: integer overflow in do_insnlist_ioctl() Staging: comedi: fix signal handling in read and write Staging: comedi: fix mmap_count staging: comedi: fix oops for USB DAQ devices. staging: comedi: usbduxsigma: Fixed wrong range for the analogue channel. staging:rts_pstor:Complete scanning_done variable staging: usbip: bugfix for deadlock
2 parents ffb8fb5 + dfd8ee9 commit f9143ea

File tree

4 files changed

+84
-30
lines changed

4 files changed

+84
-30
lines changed

‎drivers/staging/comedi/comedi_fops.c

Lines changed: 73 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -671,7 +671,7 @@ static int do_insnlist_ioctl(struct comedi_device *dev,
671671
}
672672

673673
insns =
674-
kmalloc(sizeof(struct comedi_insn) * insnlist.n_insns, GFP_KERNEL);
674+
kcalloc(insnlist.n_insns, sizeof(struct comedi_insn), GFP_KERNEL);
675675
if (!insns) {
676676
DPRINTK("kmalloc failed\n");
677677
ret = -ENOMEM;
@@ -1432,7 +1432,21 @@ static int do_cancel(struct comedi_device *dev, struct comedi_subdevice *s)
14321432
return ret;
14331433
}
14341434

1435-
static void comedi_unmap(struct vm_area_struct *area)
1435+
1436+
static void comedi_vm_open(struct vm_area_struct *area)
1437+
{
1438+
struct comedi_async *async;
1439+
struct comedi_device *dev;
1440+
1441+
async = area->vm_private_data;
1442+
dev = async->subdevice->device;
1443+
1444+
mutex_lock(&dev->mutex);
1445+
async->mmap_count++;
1446+
mutex_unlock(&dev->mutex);
1447+
}
1448+
1449+
static void comedi_vm_close(struct vm_area_struct *area)
14361450
{
14371451
struct comedi_async *async;
14381452
struct comedi_device *dev;
@@ -1446,22 +1460,29 @@ static void comedi_unmap(struct vm_area_struct *area)
14461460
}
14471461

14481462
static struct vm_operations_struct comedi_vm_ops = {
1449-
.close = comedi_unmap,
1463+
.open = comedi_vm_open,
1464+
.close = comedi_vm_close,
14501465
};
14511466

14521467
static int comedi_mmap(struct file *file, struct vm_area_struct *vma)
14531468
{
14541469
const unsigned minor = iminor(file->f_dentry->d_inode);
1455-
struct comedi_device_file_info *dev_file_info =
1456-
comedi_get_device_file_info(minor);
1457-
struct comedi_device *dev = dev_file_info->device;
14581470
struct comedi_async *async = NULL;
14591471
unsigned long start = vma->vm_start;
14601472
unsigned long size;
14611473
int n_pages;
14621474
int i;
14631475
int retval;
14641476
struct comedi_subdevice *s;
1477+
struct comedi_device_file_info *dev_file_info;
1478+
struct comedi_device *dev;
1479+
1480+
dev_file_info = comedi_get_device_file_info(minor);
1481+
if (dev_file_info == NULL)
1482+
return -ENODEV;
1483+
dev = dev_file_info->device;
1484+
if (dev == NULL)
1485+
return -ENODEV;
14651486

14661487
mutex_lock(&dev->mutex);
14671488
if (!dev->attached) {
@@ -1528,11 +1549,17 @@ static unsigned int comedi_poll(struct file *file, poll_table * wait)
15281549
{
15291550
unsigned int mask = 0;
15301551
const unsigned minor = iminor(file->f_dentry->d_inode);
1531-
struct comedi_device_file_info *dev_file_info =
1532-
comedi_get_device_file_info(minor);
1533-
struct comedi_device *dev = dev_file_info->device;
15341552
struct comedi_subdevice *read_subdev;
15351553
struct comedi_subdevice *write_subdev;
1554+
struct comedi_device_file_info *dev_file_info;
1555+
struct comedi_device *dev;
1556+
dev_file_info = comedi_get_device_file_info(minor);
1557+
1558+
if (dev_file_info == NULL)
1559+
return -ENODEV;
1560+
dev = dev_file_info->device;
1561+
if (dev == NULL)
1562+
return -ENODEV;
15361563

15371564
mutex_lock(&dev->mutex);
15381565
if (!dev->attached) {
@@ -1578,9 +1605,15 @@ static ssize_t comedi_write(struct file *file, const char __user *buf,
15781605
int n, m, count = 0, retval = 0;
15791606
DECLARE_WAITQUEUE(wait, current);
15801607
const unsigned minor = iminor(file->f_dentry->d_inode);
1581-
struct comedi_device_file_info *dev_file_info =
1582-
comedi_get_device_file_info(minor);
1583-
struct comedi_device *dev = dev_file_info->device;
1608+
struct comedi_device_file_info *dev_file_info;
1609+
struct comedi_device *dev;
1610+
dev_file_info = comedi_get_device_file_info(minor);
1611+
1612+
if (dev_file_info == NULL)
1613+
return -ENODEV;
1614+
dev = dev_file_info->device;
1615+
if (dev == NULL)
1616+
return -ENODEV;
15841617

15851618
if (!dev->attached) {
15861619
DPRINTK("no driver configured on comedi%i\n", dev->minor);
@@ -1640,11 +1673,11 @@ static ssize_t comedi_write(struct file *file, const char __user *buf,
16401673
retval = -EAGAIN;
16411674
break;
16421675
}
1676+
schedule();
16431677
if (signal_pending(current)) {
16441678
retval = -ERESTARTSYS;
16451679
break;
16461680
}
1647-
schedule();
16481681
if (!s->busy)
16491682
break;
16501683
if (s->busy != file) {
@@ -1683,9 +1716,15 @@ static ssize_t comedi_read(struct file *file, char __user *buf, size_t nbytes,
16831716
int n, m, count = 0, retval = 0;
16841717
DECLARE_WAITQUEUE(wait, current);
16851718
const unsigned minor = iminor(file->f_dentry->d_inode);
1686-
struct comedi_device_file_info *dev_file_info =
1687-
comedi_get_device_file_info(minor);
1688-
struct comedi_device *dev = dev_file_info->device;
1719+
struct comedi_device_file_info *dev_file_info;
1720+
struct comedi_device *dev;
1721+
dev_file_info = comedi_get_device_file_info(minor);
1722+
1723+
if (dev_file_info == NULL)
1724+
return -ENODEV;
1725+
dev = dev_file_info->device;
1726+
if (dev == NULL)
1727+
return -ENODEV;
16891728

16901729
if (!dev->attached) {
16911730
DPRINTK("no driver configured on comedi%i\n", dev->minor);
@@ -1741,11 +1780,11 @@ static ssize_t comedi_read(struct file *file, char __user *buf, size_t nbytes,
17411780
retval = -EAGAIN;
17421781
break;
17431782
}
1783+
schedule();
17441784
if (signal_pending(current)) {
17451785
retval = -ERESTARTSYS;
17461786
break;
17471787
}
1748-
schedule();
17491788
if (!s->busy) {
17501789
retval = 0;
17511790
break;
@@ -1885,11 +1924,17 @@ static int comedi_open(struct inode *inode, struct file *file)
18851924
static int comedi_close(struct inode *inode, struct file *file)
18861925
{
18871926
const unsigned minor = iminor(inode);
1888-
struct comedi_device_file_info *dev_file_info =
1889-
comedi_get_device_file_info(minor);
1890-
struct comedi_device *dev = dev_file_info->device;
18911927
struct comedi_subdevice *s = NULL;
18921928
int i;
1929+
struct comedi_device_file_info *dev_file_info;
1930+
struct comedi_device *dev;
1931+
dev_file_info = comedi_get_device_file_info(minor);
1932+
1933+
if (dev_file_info == NULL)
1934+
return -ENODEV;
1935+
dev = dev_file_info->device;
1936+
if (dev == NULL)
1937+
return -ENODEV;
18931938

18941939
mutex_lock(&dev->mutex);
18951940

@@ -1923,10 +1968,15 @@ static int comedi_close(struct inode *inode, struct file *file)
19231968
static int comedi_fasync(int fd, struct file *file, int on)
19241969
{
19251970
const unsigned minor = iminor(file->f_dentry->d_inode);
1926-
struct comedi_device_file_info *dev_file_info =
1927-
comedi_get_device_file_info(minor);
1971+
struct comedi_device_file_info *dev_file_info;
1972+
struct comedi_device *dev;
1973+
dev_file_info = comedi_get_device_file_info(minor);
19281974

1929-
struct comedi_device *dev = dev_file_info->device;
1975+
if (dev_file_info == NULL)
1976+
return -ENODEV;
1977+
dev = dev_file_info->device;
1978+
if (dev == NULL)
1979+
return -ENODEV;
19301980

19311981
return fasync_helper(fd, file, on, &dev->async_queue);
19321982
}

‎drivers/staging/comedi/drivers/usbduxsigma.c

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
#define DRIVER_VERSION "v0.5"
1+
#define DRIVER_VERSION "v0.6"
22
#define DRIVER_AUTHOR "Bernd Porr, [email protected]"
33
#define DRIVER_DESC "Stirling/ITL USB-DUX SIGMA -- [email protected]"
44
/*
@@ -25,7 +25,7 @@ Driver: usbduxsigma
2525
Description: University of Stirling USB DAQ & INCITE Technology Limited
2626
Devices: [ITL] USB-DUX (usbduxsigma.o)
2727
Author: Bernd Porr <[email protected]>
28-
Updated: 21 Jul 2011
28+
Updated: 8 Nov 2011
2929
Status: testing
3030
*/
3131
/*
@@ -44,6 +44,7 @@ Status: testing
4444
* 0.3: proper vendor ID and driver name
4545
* 0.4: fixed D/A voltage range
4646
* 0.5: various bug fixes, health check at startup
47+
* 0.6: corrected wrong input range
4748
*/
4849

4950
/* generates loads of debug info */
@@ -175,7 +176,7 @@ Status: testing
175176
/* comedi constants */
176177
static const struct comedi_lrange range_usbdux_ai_range = { 1, {
177178
BIP_RANGE
178-
(2.65)
179+
(2.65/2.0)
179180
}
180181
};
181182

‎drivers/staging/rts_pstor/rtsx.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1021,6 +1021,7 @@ static int __devinit rtsx_probe(struct pci_dev *pci,
10211021
th = kthread_create(rtsx_scan_thread, dev, "rtsx-scan");
10221022
if (IS_ERR(th)) {
10231023
printk(KERN_ERR "Unable to start the device-scanning thread\n");
1024+
complete(&dev->scanning_done);
10241025
quiesce_and_remove_host(dev);
10251026
err = PTR_ERR(th);
10261027
goto errout;

‎drivers/staging/usbip/vhci_rx.c

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,7 @@ static void vhci_recv_ret_submit(struct vhci_device *vdev,
6868
{
6969
struct usbip_device *ud = &vdev->ud;
7070
struct urb *urb;
71+
unsigned long flags;
7172

7273
spin_lock(&vdev->priv_lock);
7374
urb = pickup_urb_and_free_priv(vdev, pdu->base.seqnum);
@@ -101,9 +102,9 @@ static void vhci_recv_ret_submit(struct vhci_device *vdev,
101102

102103
usbip_dbg_vhci_rx("now giveback urb %p\n", urb);
103104

104-
spin_lock(&the_controller->lock);
105+
spin_lock_irqsave(&the_controller->lock, flags);
105106
usb_hcd_unlink_urb_from_ep(vhci_to_hcd(the_controller), urb);
106-
spin_unlock(&the_controller->lock);
107+
spin_unlock_irqrestore(&the_controller->lock, flags);
107108

108109
usb_hcd_giveback_urb(vhci_to_hcd(the_controller), urb, urb->status);
109110

@@ -141,6 +142,7 @@ static void vhci_recv_ret_unlink(struct vhci_device *vdev,
141142
{
142143
struct vhci_unlink *unlink;
143144
struct urb *urb;
145+
unsigned long flags;
144146

145147
usbip_dump_header(pdu);
146148

@@ -170,9 +172,9 @@ static void vhci_recv_ret_unlink(struct vhci_device *vdev,
170172
urb->status = pdu->u.ret_unlink.status;
171173
pr_info("urb->status %d\n", urb->status);
172174

173-
spin_lock(&the_controller->lock);
175+
spin_lock_irqsave(&the_controller->lock, flags);
174176
usb_hcd_unlink_urb_from_ep(vhci_to_hcd(the_controller), urb);
175-
spin_unlock(&the_controller->lock);
177+
spin_unlock_irqrestore(&the_controller->lock, flags);
176178

177179
usb_hcd_giveback_urb(vhci_to_hcd(the_controller), urb,
178180
urb->status);

0 commit comments

Comments
 (0)