linux/drivers/staging/comedi, branch v3.2.2

Staging: comedi: fix integer overflow in do_insnlist_ioctl()

2011-11-27T19:38:45Z

There is a potential integer overflow in do_insnlist_ioctl() if userspace passes in a large insnlist.n_insns. The call to kmalloc() would allocate a small buffer, leading to a memory corruption. The bug was reported by Dan Carpenter and Haogang Chen . The patch was suggested by Ian Abbott and Lars-Peter Clausen . Reported-by: Dan Carpenter Reported-by: Haogang Chen . Cc: Ian Abbott Cc: Lars-Peter Clausen Signed-off-by: Xi Wang Signed-off-by: Greg Kroah-Hartman

Revert "Staging: comedi: integer overflow in do_insnlist_ioctl()"

2011-11-27T19:36:10Z

This reverts commit e384a41141949843899affcf51f4e6e646c1fe9f. It's not the correct way to solve this issue. Acked-by: Dan Carpenter Signed-off-by: Greg Kroah-Hartman

Staging: comedi: integer overflow in do_insnlist_ioctl()

2011-11-27T02:34:15Z

There is an integer overflow here that could cause memory corruption on 32 bit systems. insnlist.n_insns could be a very high value size calculation for kmalloc() could overflow resulting in a smaller "insns" than expected. In the for (i = 0; i < insnlist.n_insns; i++) {... loop we would read past the end of the buffer, possibly corrupting memory as well. Signed-off-by: Dan Carpenter Signed-off-by: Greg Kroah-Hartman

Staging: comedi: fix signal handling in read and write

2011-11-27T02:34:15Z

After sleeping on a wait queue, signal_pending(current) should be checked (not before sleeping). Acked-by: Alessandro Rubini Signed-off-by: Federico Vaga Cc: stable Signed-off-by: Greg Kroah-Hartman

Staging: comedi: fix mmap_count

2011-11-27T02:34:14Z

In comedi_fops, mmap_count is decremented at comedi_vm_ops->close but it is not incremented at comedi_vm_ops->open. This may result in a negative counter. The patch introduces the open method to keep the counter consistent. The bug was triggerd by this sample code: mmap(0, ...., comedi_fd); fork(); exit(0); Acked-by: Alessandro Rubini Signed-off-by: Federico Vaga Cc: stable Signed-off-by: Greg Kroah-Hartman

staging: comedi: fix oops for USB DAQ devices.

2011-11-27T02:34:14Z

This fixes kernel oops when an USB DAQ device is plugged out while it's communicating with the userspace software. Signed-off-by: Bernd Porr Cc: stable Signed-off-by: Greg Kroah-Hartman

staging: comedi: usbduxsigma: Fixed wrong range for the analogue channel.

2011-11-27T02:34:14Z

It's actually +/-2.65V/2 and not +/-2.65V. Signed-off-by: Bernd Porr Cc: stable Signed-off-by: Greg Kroah-Hartman

Staging: comedi: fix brace coding style issue in ni_atmio.c

2011-10-17T22:11:30Z

This is a patch to the ni_atmio.c file which fixes a brace and whitespace warning found by the checkpatch.pl tool Signed-off-by: Jake Burton Signed-off-by: Greg Kroah-Hartman

Staging: comedi: c6xdigio: fixed missing KERN_* in printk

2011-10-17T22:11:30Z

Fixed missing KERN_* in printk statements. Signed-off-by: Nasir Abed Signed-off-by: Greg Kroah-Hartman

drivers:staging:comedi:drivers:cb_das_cs.c codeing style issue

2011-09-27T00:43:45Z

drivers: staging: comedi: cb_das16_cs.c fixed over 80 line issue, and removed a space before tab issue. Signed-off-by: Christopher Rice Signed-off-by: Greg Kroah-Hartman