Skip to content

L
linux
Switch branch/tag
  1. 21 Sep, 2012 37 commits
  3. 19 Sep, 2012 3 commits
    • Ian Abbott's avatar
      staging: comedi: don't dereference user memory for INSN_INTTRIG · 5d06e3df
      Ian Abbott authored 
      `parse_insn()` is dereferencing the user-space pointer `insn->data`
directly when handling the `INSN_INTTRIG` comedi instruction.  It
shouldn't be using `insn->data` at all; it should be using the separate
`data` pointer passed to the function.  Fix it.

Cc: stable <stable@vger.kernel.org>
Signed-off-by: default avatarIan Abbott <abbotti@mev.co.uk>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      5d06e3df
    • Ian Abbott's avatar
      staging: comedi: sparse warning in insn_rw_emulate_bits() · 9f82e957
      Ian Abbott authored 
      `insn_rw_emulate_bits()` is used to emulate the `INSN_READ` and
`INSN_WRITE` comedi instructions for subdevices that don't have an
`insn_read()` or `insn_write()` handler but do have an `insn_bits()`
handler.

The function fills in a temporary `struct comedi_insn` called `new_insn`
to pass to the subdevice's `insn_bits()` handler.  In doing so, it sets
the `new_insn.data` pointer to point to a temporary data array.  This
results in a warning from "sparse" because the `data` pointer in `struct
comedi_insn` has the `__user` tag.  The subdevice's `insn_bits()`
handler ignores it anyway as it gets passed a pointer to the temporary
data array in a separate parameter.  Don't bother setting
`new_insn.data`; just leave it set to `NULL` (done by an earlier
`memset()`).
Signed-off-by: default avatarIan Abbott <abbotti@mev.co.uk>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      9f82e957
    • Ian Abbott's avatar
      staging: comedi: fix sparse warning in do_devconfig_ioctl() · dc881f29
      Ian Abbott authored 
      For the COMEDI_DEVCONFIG ioctl, the user application may embed a pointer
to firmware data within a designated element (or two elements for 64-bit
pointers) of the `options[]` array in the `struct comedi_devconfig`.
`do_devconfig_ioctl()` calls `comedi_aux_data()` to extract the pointer
value.  It needs to be treated as a `__user` pointer so the firmware
data can be copied into kernel memory, so cast the result of
`comedi_aux_data()` to avoid a "sparse" warning.  This is not ideal but
`comedi_aux_data()` is called elsewhere in a wholly kernel memory
context so we can't just change its return type to include the `__user`
tag.
Signed-off-by: default avatarIan Abbott <abbotti@mev.co.uk>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      dc881f29
GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7