Commits · 8ea939284d3ebde02d5b46d50406c2b7faae1214 · Kirill Smelkov / linux

13 Oct, 2015 40 commits

staging: comedi: avoid bad truncation of a size_t in comedi_read() · 8ea93928

Ian Abbott authored Oct 12, 2015

At one point in `comedi_read()`, the variable `n` gets assigned to the
minimum of the parameter `nbytes` and the amount of readable buffer
space `m`.  The way that is done currently is unsafe in the unlikely
case that `nbytes` exceeds `UINT_MAX`, so fix it.
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Reviewed-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

8ea93928

staging: comedi: make some variables unsigned in comedi_read() · 76e8e7d4

Ian Abbott authored Oct 12, 2015

In `comedi_read()`, the `n` and `m` variables are of type `int`.  Change
them to `unsigned int` as they are used to measure a positive number of
bytes.  The `count` variable is also of type `int` and holds the
returned number of bytes.  Change it to type `ssize_t` to match the
function's return type.
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Reviewed-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

76e8e7d4

staging: comedi: do extra checks for becoming non-busy for "read" · fd060c8f

Ian Abbott authored Oct 12, 2015

`comedi_read()` is the handler for the "read" file operation for COMEDI
devices. It mostly runs without using the main mutex of the COMEDI
device, but uses the `attach_lock` rwsemaphore to protect against the
COMEDI device becoming "detached". A file object can read data
resulting from a COMEDI asynchonous command if it initiated the command.
The COMEDI subdevice is marked as busy when the command is started. At
some point, the "read" handler detects that the command has terminated
and all available data has been read and so marks the subdevice as
non-busy.

In order to mark the subdevice as non-busy, the "read" handler needs to
release the `attach_lock` rwsemaphore and `acquire the main `mutex`.
There is a vulnerable point between the two, so it checks that the
device is still attached after acquiring the mutex. However, it does
not currently check that the conditions for becoming non-busy still
hold. Add some more checks that the subdevice is still busy with a
command initiated by the same file object, that command is in the correct
direction (in case the subdevice supports both "read" and "write"), that
command has terminated, and has no data available to be read.
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Reviewed-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

fd060c8f

staging: comedi: don't consider "unmunged" data when becoming non-busy · 09d6b9a9

Ian Abbott authored Oct 12, 2015

If an asynchronous "read" command is no longer running but the subdevice
is still busy, it becomes non-busy once there is no more data available
in the buffer.  Some or all of the data written to the buffer might not
have been "munged" yet, and it cannot be read until it has been munged
by the writer.  However, since the command is no longer running, we
cannot expect any remaining unmunged data to get munged so we should
ignore it.  Call `comedi_buf_read_n_available()` to check the amount of
munged data available to be read, replacing the call to
`comedi_buf_n_bytes_ready()` which checked the amount of written (but
possibly not yet munged) data available to be read.  This affects both
the "read" file operation (done in `comedi_read()`) and the
`COMEDI_BUFINFO` ioctl handling (done in `do_bufinfo_ioctl()`).  (The
latter is used when data is transferred directly through the mmapped
buffer instead of via the "read" file operation.)
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Reviewed-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

09d6b9a9

staging: comedi: remain busy until read end-of-file · 970679b0

Ian Abbott authored Oct 12, 2015

If a COMEDI subdevice is busy handling an asynchronous command in the
"read" direction, then after the command has terminated itself, the
"read" file operation handler, `comedi_read()` should keep the subdevice
busy until all available data has been read and it has returned 0 to
indicate an "end-of-file" condition.  Currently, it has a bug where it
can mark the subdevice as non-busy even when returning a non-zero count.
The bug is slightly hidden because the next "read" will return 0 because
the subdevice is no longer busy.  Fix it by checking the return count is
0 before deciding to mark the subdevice as non-busy.

The call to `comedi_is_subdevice_idle()` is superfluous as the
`become_nonbusy` variable will have been set to `true` when considering
becoming non-busy.  Strictly speaking, checking the return count is
superfluous too, as `become_nonbusy` doesn't get set to `true` unless
the count is 0, but check the return count anyway to make the intention
clearer.
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Reviewed-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

970679b0

staging: comedi: don't use mutex when polling file · d5eb3a74