driverdev-devel.linuxdriverproject.org archive mirror
 help / color / mirror / Atom feed
* [PATCH 00/14] staging: comedi: Fix some command data endian problems
@ 2021-02-23 14:30 Ian Abbott
  2021-02-23 14:30 ` [PATCH 01/14] staging: comedi: addi_apci_1032: Fix endian problem for COS sample Ian Abbott
                   ` (13 more replies)
  0 siblings, 14 replies; 15+ messages in thread
From: Ian Abbott @ 2021-02-23 14:30 UTC (permalink / raw)
  To: devel; +Cc: Greg Kroah-Hartman, Ian Abbott

The `comedi_buf_read_samples()` and `comedi_buf_write_samples()`
functions can read/write either 16-bit or 32-bit values from/to the
Comedi buffer used for Comedi asynchonous command data.  The width of
the value depends on whether the subdevice sets the `SDF_LSAMPL` flag
(indicating 32-bit samples, if set).

Various Comedi drivers are calling `comedi_buf_write_samples()` with the
address of an object of type `unsigned int` when the subdevice is set to
use 16-bit wide samples (`SDF_LSAMPL` flag clear).  That will not work
properly on bigendian machines because it will be transferring a 2-byte
value from the wrong end of the 32-bit integer.  This patch series fixes
those problems.

For some of the drivers, the value being transferred is always 0 anyway,
so it doesn't matter much, but fix them anyway in patches 10 thru 14.

01) staging: comedi: addi_apci_1032: Fix endian problem for COS sample
02) staging: comedi: addi_apci_1500: Fix endian problem for command sample
03) staging: comedi: adv_pci1710: Fix endian problem for AI command data
04) staging: comedi: das6402: Fix endian problem for AI command data
05) staging: comedi: das800: Fix endian problem for AI command data
06) staging: comedi: dmm32at: Fix endian problem for AI command data
07) staging: comedi: me4000: Fix endian problem for AI command data
08) staging: comedi: pcl711: Fix endian problem for AI command data
09) staging: comedi: pcl818: Fix endian problem for AI command data
10) staging: comedi: amplc_pc236_common: Use 16-bit 0 for interrupt data
11) staging: comedi: comedi_parport: Use 16-bit 0 for interrupt data
12) staging: comedi: ni_6527: Use 16-bit 0 for interrupt data
13) staging: comedi: ni_65xx: Use 16-bit 0 for interrupt data
14) staging: comedi: pcl726: Use 16-bit 0 for interrupt data

 drivers/staging/comedi/drivers/addi_apci_1032.c     |  4 +++-
 drivers/staging/comedi/drivers/addi_apci_1500.c     | 18 +++++++++---------
 drivers/staging/comedi/drivers/adv_pci1710.c        | 10 +++++-----
 drivers/staging/comedi/drivers/amplc_pc236_common.c |  4 +++-
 drivers/staging/comedi/drivers/comedi_parport.c     |  3 ++-
 drivers/staging/comedi/drivers/das6402.c            |  2 +-
 drivers/staging/comedi/drivers/das800.c             |  2 +-
 drivers/staging/comedi/drivers/dmm32at.c            |  2 +-
 drivers/staging/comedi/drivers/me4000.c             |  2 +-
 drivers/staging/comedi/drivers/ni_6527.c            |  4 +++-
 drivers/staging/comedi/drivers/ni_65xx.c            |  3 ++-
 drivers/staging/comedi/drivers/pcl711.c             |  2 +-
 drivers/staging/comedi/drivers/pcl726.c             |  4 +++-
 drivers/staging/comedi/drivers/pcl818.c             |  2 +-
 14 files changed, 36 insertions(+), 26 deletions(-)

_______________________________________________
devel mailing list
devel@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel

^ permalink raw reply	[flat|nested] 15+ messages in thread

* [PATCH 01/14] staging: comedi: addi_apci_1032: Fix endian problem for COS sample
  2021-02-23 14:30 [PATCH 00/14] staging: comedi: Fix some command data endian problems Ian Abbott
@ 2021-02-23 14:30 ` Ian Abbott
  2021-02-23 14:30 ` [PATCH 02/14] staging: comedi: addi_apci_1500: Fix endian problem for command sample Ian Abbott
                   ` (12 subsequent siblings)
  13 siblings, 0 replies; 15+ messages in thread
From: Ian Abbott @ 2021-02-23 14:30 UTC (permalink / raw)
  To: devel; +Cc: Greg Kroah-Hartman, Ian Abbott, stable

The Change-Of-State (COS) subdevice supports Comedi asynchronous
commands to read 16-bit change-of-state values.  However, the interrupt
handler is calling `comedi_buf_write_samples()` with the address of a
32-bit integer `&s->state`.  On bigendian architectures, it will copy 2
bytes from the wrong end of the 32-bit integer.  Fix it by transferring
the value via a 16-bit integer.

Fixes: 6bb45f2b0c86 ("staging: comedi: addi_apci_1032: use comedi_buf_write_samples()"
Cc: <stable@vger.kernel.org> # 3.19+
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
---
 drivers/staging/comedi/drivers/addi_apci_1032.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/comedi/drivers/addi_apci_1032.c b/drivers/staging/comedi/drivers/addi_apci_1032.c
index 35b75f0c9200..81a246fbcc01 100644
--- a/drivers/staging/comedi/drivers/addi_apci_1032.c
+++ b/drivers/staging/comedi/drivers/addi_apci_1032.c
@@ -260,6 +260,7 @@ static irqreturn_t apci1032_interrupt(int irq, void *d)
 	struct apci1032_private *devpriv = dev->private;
 	struct comedi_subdevice *s = dev->read_subdev;
 	unsigned int ctrl;
+	unsigned short val;
 
 	/* check interrupt is from this device */
 	if ((inl(devpriv->amcc_iobase + AMCC_OP_REG_INTCSR) &
@@ -275,7 +276,8 @@ static irqreturn_t apci1032_interrupt(int irq, void *d)
 	outl(ctrl & ~APCI1032_CTRL_INT_ENA, dev->iobase + APCI1032_CTRL_REG);
 
 	s->state = inl(dev->iobase + APCI1032_STATUS_REG) & 0xffff;
-	comedi_buf_write_samples(s, &s->state, 1);
+	val = s->state;
+	comedi_buf_write_samples(s, &val, 1);
 	comedi_handle_events(dev, s);
 
 	/* enable the interrupt */
-- 
2.30.0

_______________________________________________
devel mailing list
devel@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel

^ permalink raw reply related	[flat|nested] 15+ messages in thread

* [PATCH 02/14] staging: comedi: addi_apci_1500: Fix endian problem for command sample
  2021-02-23 14:30 [PATCH 00/14] staging: comedi: Fix some command data endian problems Ian Abbott
  2021-02-23 14:30 ` [PATCH 01/14] staging: comedi: addi_apci_1032: Fix endian problem for COS sample Ian Abbott
@ 2021-02-23 14:30 ` Ian Abbott
  2021-02-23 14:30 ` [PATCH 03/14] staging: comedi: adv_pci1710: Fix endian problem for AI command data Ian Abbott
                   ` (11 subsequent siblings)
  13 siblings, 0 replies; 15+ messages in thread
From: Ian Abbott @ 2021-02-23 14:30 UTC (permalink / raw)
  To: devel; +Cc: Greg Kroah-Hartman, Ian Abbott, stable

The digital input subdevice supports Comedi asynchronous commands that
read interrupt status information.  This uses 16-bit Comedi samples (of
which only the bottom 8 bits contain status information).  However, the
interrupt handler is calling `comedi_buf_write_samples()` with the
address of a 32-bit variable `unsigned int status`.  On a bigendian
machine, this will copy 2 bytes from the wrong end of the variable.  Fix
it by changing the type of the variable to `unsigned short`.

Fixes: a8c66b684efa ("staging: comedi: addi_apci_1500: rewrite the subdevice support functions")
Cc: <stable@vger.kernel.org> #4.0+
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
---
 .../staging/comedi/drivers/addi_apci_1500.c    | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/drivers/staging/comedi/drivers/addi_apci_1500.c b/drivers/staging/comedi/drivers/addi_apci_1500.c
index 11efb21555e3..b04c15dcfb57 100644
--- a/drivers/staging/comedi/drivers/addi_apci_1500.c
+++ b/drivers/staging/comedi/drivers/addi_apci_1500.c
@@ -208,7 +208,7 @@ static irqreturn_t apci1500_interrupt(int irq, void *d)
 	struct comedi_device *dev = d;
 	struct apci1500_private *devpriv = dev->private;
 	struct comedi_subdevice *s = dev->read_subdev;
-	unsigned int status = 0;
+	unsigned short status = 0;
 	unsigned int val;
 
 	val = inl(devpriv->amcc + AMCC_OP_REG_INTCSR);
@@ -238,14 +238,14 @@ static irqreturn_t apci1500_interrupt(int irq, void *d)
 	 *
 	 *    Mask     Meaning
 	 * ----------  ------------------------------------------
-	 * 0x00000001  Event 1 has occurred
-	 * 0x00000010  Event 2 has occurred
-	 * 0x00000100  Counter/timer 1 has run down (not implemented)
-	 * 0x00001000  Counter/timer 2 has run down (not implemented)
-	 * 0x00010000  Counter 3 has run down (not implemented)
-	 * 0x00100000  Watchdog has run down (not implemented)
-	 * 0x01000000  Voltage error
-	 * 0x10000000  Short-circuit error
+	 * 0b00000001  Event 1 has occurred
+	 * 0b00000010  Event 2 has occurred
+	 * 0b00000100  Counter/timer 1 has run down (not implemented)
+	 * 0b00001000  Counter/timer 2 has run down (not implemented)
+	 * 0b00010000  Counter 3 has run down (not implemented)
+	 * 0b00100000  Watchdog has run down (not implemented)
+	 * 0b01000000  Voltage error
+	 * 0b10000000  Short-circuit error
 	 */
 	comedi_buf_write_samples(s, &status, 1);
 	comedi_handle_events(dev, s);
-- 
2.30.0

_______________________________________________
devel mailing list
devel@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel

^ permalink raw reply related	[flat|nested] 15+ messages in thread

* [PATCH 03/14] staging: comedi: adv_pci1710: Fix endian problem for AI command data
  2021-02-23 14:30 [PATCH 00/14] staging: comedi: Fix some command data endian problems Ian Abbott
  2021-02-23 14:30 ` [PATCH 01/14] staging: comedi: addi_apci_1032: Fix endian problem for COS sample Ian Abbott
  2021-02-23 14:30 ` [PATCH 02/14] staging: comedi: addi_apci_1500: Fix endian problem for command sample Ian Abbott
@ 2021-02-23 14:30 ` Ian Abbott
  2021-02-23 14:30 ` [PATCH 04/14] staging: comedi: das6402: " Ian Abbott
                   ` (10 subsequent siblings)
  13 siblings, 0 replies; 15+ messages in thread
From: Ian Abbott @ 2021-02-23 14:30 UTC (permalink / raw)
  To: devel; +Cc: Greg Kroah-Hartman, Ian Abbott, stable

The analog input subdevice supports Comedi asynchronous commands that
use Comedi's 16-bit sample format.  However, the calls to
`comedi_buf_write_samples()` are passing the address of a 32-bit integer
variable.  On bigendian machines, this will copy 2 bytes from the wrong
end of the 32-bit value.  Fix it by changing the type of the variables
holding the sample value to `unsigned short`.  The type of the `val`
parameter of `pci1710_ai_read_sample()` is changed to `unsigned short *`
accordingly.  The type of the `val` variable in `pci1710_ai_insn_read()`
is also changed to `unsigned short` since its address is passed to
`pci1710_ai_read_sample()`.

Fixes: a9c3a015c12f ("staging: comedi: adv_pci1710: use comedi_buf_write_samples()")
Cc: <stable@vger.kernel.org> # 4.0+
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
---
 drivers/staging/comedi/drivers/adv_pci1710.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/staging/comedi/drivers/adv_pci1710.c b/drivers/staging/comedi/drivers/adv_pci1710.c
index 692893c7e5c3..090607760be6 100644
--- a/drivers/staging/comedi/drivers/adv_pci1710.c
+++ b/drivers/staging/comedi/drivers/adv_pci1710.c
@@ -300,11 +300,11 @@ static int pci1710_ai_eoc(struct comedi_device *dev,
 static int pci1710_ai_read_sample(struct comedi_device *dev,
 				  struct comedi_subdevice *s,
 				  unsigned int cur_chan,
-				  unsigned int *val)
+				  unsigned short *val)
 {
 	const struct boardtype *board = dev->board_ptr;
 	struct pci1710_private *devpriv = dev->private;
-	unsigned int sample;
+	unsigned short sample;
 	unsigned int chan;
 
 	sample = inw(dev->iobase + PCI171X_AD_DATA_REG);
@@ -345,7 +345,7 @@ static int pci1710_ai_insn_read(struct comedi_device *dev,
 	pci1710_ai_setup_chanlist(dev, s, &insn->chanspec, 1, 1);
 
 	for (i = 0; i < insn->n; i++) {
-		unsigned int val;
+		unsigned short val;
 
 		/* start conversion */
 		outw(0, dev->iobase + PCI171X_SOFTTRG_REG);
@@ -395,7 +395,7 @@ static void pci1710_handle_every_sample(struct comedi_device *dev,
 {
 	struct comedi_cmd *cmd = &s->async->cmd;
 	unsigned int status;
-	unsigned int val;
+	unsigned short val;
 	int ret;
 
 	status = inw(dev->iobase + PCI171X_STATUS_REG);
@@ -455,7 +455,7 @@ static void pci1710_handle_fifo(struct comedi_device *dev,
 	}
 
 	for (i = 0; i < devpriv->max_samples; i++) {
-		unsigned int val;
+		unsigned short val;
 		int ret;
 
 		ret = pci1710_ai_read_sample(dev, s, s->async->cur_chan, &val);
-- 
2.30.0

_______________________________________________
devel mailing list
devel@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel

^ permalink raw reply related	[flat|nested] 15+ messages in thread

* [PATCH 04/14] staging: comedi: das6402: Fix endian problem for AI command data
  2021-02-23 14:30 [PATCH 00/14] staging: comedi: Fix some command data endian problems Ian Abbott
                   ` (2 preceding siblings ...)
  2021-02-23 14:30 ` [PATCH 03/14] staging: comedi: adv_pci1710: Fix endian problem for AI command data Ian Abbott
@ 2021-02-23 14:30 ` Ian Abbott
  2021-02-23 14:30 ` [PATCH 05/14] staging: comedi: das800: " Ian Abbott
                   ` (9 subsequent siblings)
  13 siblings, 0 replies; 15+ messages in thread
From: Ian Abbott @ 2021-02-23 14:30 UTC (permalink / raw)
  To: devel; +Cc: Greg Kroah-Hartman, Ian Abbott, stable

The analog input subdevice supports Comedi asynchronous commands that
use Comedi's 16-bit sample format.  However, the call to
`comedi_buf_write_samples()` is passing the address of a 32-bit integer
variable.  On bigendian machines, this will copy 2 bytes from the wrong
end of the 32-bit value.  Fix it by changing the type of the variable
holding the sample value to `unsigned short`.

Fixes: d1d24cb65ee3 ("staging: comedi: das6402: read analog input samples in interrupt handler")
Cc: <stable@vger.kernel.org> # 3.19+
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
---
 drivers/staging/comedi/drivers/das6402.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/comedi/drivers/das6402.c b/drivers/staging/comedi/drivers/das6402.c
index 04e224f8b779..96f4107b8054 100644
--- a/drivers/staging/comedi/drivers/das6402.c
+++ b/drivers/staging/comedi/drivers/das6402.c
@@ -186,7 +186,7 @@ static irqreturn_t das6402_interrupt(int irq, void *d)
 	if (status & DAS6402_STATUS_FFULL) {
 		async->events |= COMEDI_CB_OVERFLOW;
 	} else if (status & DAS6402_STATUS_FFNE) {
-		unsigned int val;
+		unsigned short val;
 
 		val = das6402_ai_read_sample(dev, s);
 		comedi_buf_write_samples(s, &val, 1);
-- 
2.30.0

_______________________________________________
devel mailing list
devel@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel

^ permalink raw reply related	[flat|nested] 15+ messages in thread

* [PATCH 05/14] staging: comedi: das800: Fix endian problem for AI command data
  2021-02-23 14:30 [PATCH 00/14] staging: comedi: Fix some command data endian problems Ian Abbott
                   ` (3 preceding siblings ...)
  2021-02-23 14:30 ` [PATCH 04/14] staging: comedi: das6402: " Ian Abbott
@ 2021-02-23 14:30 ` Ian Abbott
  2021-02-23 14:30 ` [PATCH 06/14] staging: comedi: dmm32at: " Ian Abbott
                   ` (8 subsequent siblings)
  13 siblings, 0 replies; 15+ messages in thread
From: Ian Abbott @ 2021-02-23 14:30 UTC (permalink / raw)
  To: devel; +Cc: Greg Kroah-Hartman, Ian Abbott, stable

The analog input subdevice supports Comedi asynchronous commands that
use Comedi's 16-bit sample format.  However, the call to
`comedi_buf_write_samples()` is passing the address of a 32-bit integer
variable.  On bigendian machines, this will copy 2 bytes from the wrong
end of the 32-bit value.  Fix it by changing the type of the variable
holding the sample value to `unsigned short`.

Fixes: ad9eb43c93d8 ("staging: comedi: das800: use comedi_buf_write_samples()"
Cc: <stable@vger.kernel.org> # 3.19+
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
---
 drivers/staging/comedi/drivers/das800.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/comedi/drivers/das800.c b/drivers/staging/comedi/drivers/das800.c
index 4ea100ff6930..2881808d6606 100644
--- a/drivers/staging/comedi/drivers/das800.c
+++ b/drivers/staging/comedi/drivers/das800.c
@@ -427,7 +427,7 @@ static irqreturn_t das800_interrupt(int irq, void *d)
 	struct comedi_cmd *cmd;
 	unsigned long irq_flags;
 	unsigned int status;
-	unsigned int val;
+	unsigned short val;
 	bool fifo_empty;
 	bool fifo_overflow;
 	int i;
-- 
2.30.0

_______________________________________________
devel mailing list
devel@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel

^ permalink raw reply related	[flat|nested] 15+ messages in thread

* [PATCH 06/14] staging: comedi: dmm32at: Fix endian problem for AI command data
  2021-02-23 14:30 [PATCH 00/14] staging: comedi: Fix some command data endian problems Ian Abbott
                   ` (4 preceding siblings ...)
  2021-02-23 14:30 ` [PATCH 05/14] staging: comedi: das800: " Ian Abbott
@ 2021-02-23 14:30 ` Ian Abbott
  2021-02-23 14:30 ` [PATCH 07/14] staging: comedi: me4000: " Ian Abbott
                   ` (7 subsequent siblings)
  13 siblings, 0 replies; 15+ messages in thread
From: Ian Abbott @ 2021-02-23 14:30 UTC (permalink / raw)
  To: devel; +Cc: Greg Kroah-Hartman, Ian Abbott, stable

The analog input subdevice supports Comedi asynchronous commands that
use Comedi's 16-bit sample format.  However, the call to
`comedi_buf_write_samples()` is passing the address of a 32-bit integer
variable.  On bigendian machines, this will copy 2 bytes from the wrong
end of the 32-bit value.  Fix it by changing the type of the variable
holding the sample value to `unsigned short`.

[Note: the bug was introduced in commit 1700529b24cc ("staging: comedi:
dmm32at: use comedi_buf_write_samples()") but the patch applies better
to the later (but in the same kernel release) commit 0c0eadadcbe6e
("staging: comedi: dmm32at: introduce dmm32_ai_get_sample()").]

Fixes: 0c0eadadcbe6e ("staging: comedi: dmm32at: introduce dmm32_ai_get_sample()")
Cc: <stable@vger.kernel.org> # 3.19+
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
---
 drivers/staging/comedi/drivers/dmm32at.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/comedi/drivers/dmm32at.c b/drivers/staging/comedi/drivers/dmm32at.c
index 17e6018918bb..56682f01242f 100644
--- a/drivers/staging/comedi/drivers/dmm32at.c
+++ b/drivers/staging/comedi/drivers/dmm32at.c
@@ -404,7 +404,7 @@ static irqreturn_t dmm32at_isr(int irq, void *d)
 {
 	struct comedi_device *dev = d;
 	unsigned char intstat;
-	unsigned int val;
+	unsigned short val;
 	int i;
 
 	if (!dev->attached) {
-- 
2.30.0

_______________________________________________
devel mailing list
devel@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel

^ permalink raw reply related	[flat|nested] 15+ messages in thread

* [PATCH 07/14] staging: comedi: me4000: Fix endian problem for AI command data
  2021-02-23 14:30 [PATCH 00/14] staging: comedi: Fix some command data endian problems Ian Abbott
                   ` (5 preceding siblings ...)
  2021-02-23 14:30 ` [PATCH 06/14] staging: comedi: dmm32at: " Ian Abbott
@ 2021-02-23 14:30 ` Ian Abbott
  2021-02-23 14:30 ` [PATCH 08/14] staging: comedi: pcl711: " Ian Abbott
                   ` (6 subsequent siblings)
  13 siblings, 0 replies; 15+ messages in thread
From: Ian Abbott @ 2021-02-23 14:30 UTC (permalink / raw)
  To: devel; +Cc: Greg Kroah-Hartman, Ian Abbott, stable

The analog input subdevice supports Comedi asynchronous commands that
use Comedi's 16-bit sample format.  However, the calls to
`comedi_buf_write_samples()` are passing the address of a 32-bit integer
variable.  On bigendian machines, this will copy 2 bytes from the wrong
end of the 32-bit value.  Fix it by changing the type of the variable
holding the sample value to `unsigned short`.

Fixes: de88924f67d ("staging: comedi: me4000: use comedi_buf_write_samples()")
Cc: <stable@vger.kernel.org> # 3.19+
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
---
 drivers/staging/comedi/drivers/me4000.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/comedi/drivers/me4000.c b/drivers/staging/comedi/drivers/me4000.c
index 726e40dc17b6..0d3d4cafce2e 100644
--- a/drivers/staging/comedi/drivers/me4000.c
+++ b/drivers/staging/comedi/drivers/me4000.c
@@ -924,7 +924,7 @@ static irqreturn_t me4000_ai_isr(int irq, void *dev_id)
 	struct comedi_subdevice *s = dev->read_subdev;
 	int i;
 	int c = 0;
-	unsigned int lval;
+	unsigned short lval;
 
 	if (!dev->attached)
 		return IRQ_NONE;
-- 
2.30.0

_______________________________________________
devel mailing list
devel@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel

^ permalink raw reply related	[flat|nested] 15+ messages in thread

* [PATCH 08/14] staging: comedi: pcl711: Fix endian problem for AI command data
  2021-02-23 14:30 [PATCH 00/14] staging: comedi: Fix some command data endian problems Ian Abbott
                   ` (6 preceding siblings ...)
  2021-02-23 14:30 ` [PATCH 07/14] staging: comedi: me4000: " Ian Abbott
@ 2021-02-23 14:30 ` Ian Abbott
  2021-02-23 14:30 ` [PATCH 09/14] staging: comedi: pcl818: " Ian Abbott
                   ` (5 subsequent siblings)
  13 siblings, 0 replies; 15+ messages in thread
From: Ian Abbott @ 2021-02-23 14:30 UTC (permalink / raw)
  To: devel; +Cc: Greg Kroah-Hartman, Ian Abbott, stable

The analog input subdevice supports Comedi asynchronous commands that
use Comedi's 16-bit sample format.  However, the call to
`comedi_buf_write_samples()` is passing the address of a 32-bit integer
variable.  On bigendian machines, this will copy 2 bytes from the wrong
end of the 32-bit value.  Fix it by changing the type of the variable
holding the sample value to `unsigned short`.

Fixes: 1f44c034de2e ("staging: comedi: pcl711: use comedi_buf_write_samples()")
Cc: <stable@vger.kernel.org> # 3.19+
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
---
 drivers/staging/comedi/drivers/pcl711.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/comedi/drivers/pcl711.c b/drivers/staging/comedi/drivers/pcl711.c
index 2dbf69e30965..bd6f42fe9e3c 100644
--- a/drivers/staging/comedi/drivers/pcl711.c
+++ b/drivers/staging/comedi/drivers/pcl711.c
@@ -184,7 +184,7 @@ static irqreturn_t pcl711_interrupt(int irq, void *d)
 	struct comedi_device *dev = d;
 	struct comedi_subdevice *s = dev->read_subdev;
 	struct comedi_cmd *cmd = &s->async->cmd;
-	unsigned int data;
+	unsigned short data;
 
 	if (!dev->attached) {
 		dev_err(dev->class_dev, "spurious interrupt\n");
-- 
2.30.0

_______________________________________________
devel mailing list
devel@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel

^ permalink raw reply related	[flat|nested] 15+ messages in thread

* [PATCH 09/14] staging: comedi: pcl818: Fix endian problem for AI command data
  2021-02-23 14:30 [PATCH 00/14] staging: comedi: Fix some command data endian problems Ian Abbott
                   ` (7 preceding siblings ...)
  2021-02-23 14:30 ` [PATCH 08/14] staging: comedi: pcl711: " Ian Abbott
@ 2021-02-23 14:30 ` Ian Abbott
  2021-02-23 14:30 ` [PATCH 10/14] staging: comedi: amplc_pc236_common: Use 16-bit 0 for interrupt data Ian Abbott
                   ` (4 subsequent siblings)
  13 siblings, 0 replies; 15+ messages in thread
From: Ian Abbott @ 2021-02-23 14:30 UTC (permalink / raw)
  To: devel; +Cc: Greg Kroah-Hartman, Ian Abbott, stable

The analog input subdevice supports Comedi asynchronous commands that
use Comedi's 16-bit sample format.  However, the call to
`comedi_buf_write_samples()` is passing the address of a 32-bit integer
parameter.  On bigendian machines, this will copy 2 bytes from the wrong
end of the 32-bit value.  Fix it by changing the type of the parameter
holding the sample value to `unsigned short`.

[Note: the bug was introduced in commit edf4537bcbf5 ("staging: comedi:
pcl818: use comedi_buf_write_samples()") but the patch applies better to
commit d615416de615 ("staging: comedi: pcl818: introduce
pcl818_ai_write_sample()").]

Fixes: d615416de615 ("staging: comedi: pcl818: introduce pcl818_ai_write_sample()")
Cc: <stable@vger.kernel.org> # 4.0+
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
---
 drivers/staging/comedi/drivers/pcl818.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/comedi/drivers/pcl818.c b/drivers/staging/comedi/drivers/pcl818.c
index 63e3011158f2..f4b4a686c710 100644
--- a/drivers/staging/comedi/drivers/pcl818.c
+++ b/drivers/staging/comedi/drivers/pcl818.c
@@ -423,7 +423,7 @@ static int pcl818_ai_eoc(struct comedi_device *dev,
 
 static bool pcl818_ai_write_sample(struct comedi_device *dev,
 				   struct comedi_subdevice *s,
-				   unsigned int chan, unsigned int val)
+				   unsigned int chan, unsigned short val)
 {
 	struct pcl818_private *devpriv = dev->private;
 	struct comedi_cmd *cmd = &s->async->cmd;
-- 
2.30.0

_______________________________________________
devel mailing list
devel@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel

^ permalink raw reply related	[flat|nested] 15+ messages in thread

* [PATCH 10/14] staging: comedi: amplc_pc236_common: Use 16-bit 0 for interrupt data
  2021-02-23 14:30 [PATCH 00/14] staging: comedi: Fix some command data endian problems Ian Abbott
                   ` (8 preceding siblings ...)
  2021-02-23 14:30 ` [PATCH 09/14] staging: comedi: pcl818: " Ian Abbott
@ 2021-02-23 14:30 ` Ian Abbott
  2021-02-23 14:30 ` [PATCH 11/14] staging: comedi: comedi_parport: " Ian Abbott
                   ` (3 subsequent siblings)
  13 siblings, 0 replies; 15+ messages in thread
From: Ian Abbott @ 2021-02-23 14:30 UTC (permalink / raw)
  To: devel; +Cc: Greg Kroah-Hartman, Ian Abbott

The Amplicon PC36AT/PCI236 common driver has an "interrupt" subdevice
that supports Comedi asynchronous commands, placing a value in the
Comedi buffer for each interrupt.  The subdevice uses Comedi's 16-bit
sample format but the interrupt handler is calling
`comedi_buf_write_samples()` with the address of a 32-bit integer
`&s->state`.  On bigendian machines, this will copy 2 bytes from the
wrong end of the 32-bit integer.  This isn't really a problem since
`s->state` will always be 0 for this subdevice, but clean it up by using
a 16-bit variable initialized to 0 to pass the value.

Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
---
 drivers/staging/comedi/drivers/amplc_pc236_common.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/comedi/drivers/amplc_pc236_common.c b/drivers/staging/comedi/drivers/amplc_pc236_common.c
index 043752663188..981d281e87a1 100644
--- a/drivers/staging/comedi/drivers/amplc_pc236_common.c
+++ b/drivers/staging/comedi/drivers/amplc_pc236_common.c
@@ -126,7 +126,9 @@ static irqreturn_t pc236_interrupt(int irq, void *d)
 
 	handled = pc236_intr_check(dev);
 	if (dev->attached && handled) {
-		comedi_buf_write_samples(s, &s->state, 1);
+		unsigned short val = 0;
+
+		comedi_buf_write_samples(s, &val, 1);
 		comedi_handle_events(dev, s);
 	}
 	return IRQ_RETVAL(handled);
-- 
2.30.0

_______________________________________________
devel mailing list
devel@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel

^ permalink raw reply related	[flat|nested] 15+ messages in thread

* [PATCH 11/14] staging: comedi: comedi_parport: Use 16-bit 0 for interrupt data
  2021-02-23 14:30 [PATCH 00/14] staging: comedi: Fix some command data endian problems Ian Abbott
                   ` (9 preceding siblings ...)
  2021-02-23 14:30 ` [PATCH 10/14] staging: comedi: amplc_pc236_common: Use 16-bit 0 for interrupt data Ian Abbott
@ 2021-02-23 14:30 ` Ian Abbott
  2021-02-23 14:30 ` [PATCH 12/14] staging: comedi: ni_6527: " Ian Abbott
                   ` (2 subsequent siblings)
  13 siblings, 0 replies; 15+ messages in thread
From: Ian Abbott @ 2021-02-23 14:30 UTC (permalink / raw)
  To: devel; +Cc: Greg Kroah-Hartman, Ian Abbott

The comedi_parport driver has an "interrupt" subdevice that supports
Comedi asynchronous commands, placing a value in the Comedi buffer for
each interrupt.  The subdevice uses Comedi's 16-bit sample format but
the interrupt handler is calling `comedi_buf_write_samples()` with the
address of a 32-bit integer `&s->state`.  On bigendian machines, this
will copy 2 bytes from the wrong end of the 32-bit integer.  This isn't
really a problem since `s->state` will always be 0 for this subdevice,
but clean it up by using a 16-bit variable initialized to 0 to pass the
value.

Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
---
 drivers/staging/comedi/drivers/comedi_parport.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/comedi/drivers/comedi_parport.c b/drivers/staging/comedi/drivers/comedi_parport.c
index 9361b2dcf949..5338b5eea440 100644
--- a/drivers/staging/comedi/drivers/comedi_parport.c
+++ b/drivers/staging/comedi/drivers/comedi_parport.c
@@ -210,12 +210,13 @@ static irqreturn_t parport_interrupt(int irq, void *d)
 	struct comedi_device *dev = d;
 	struct comedi_subdevice *s = dev->read_subdev;
 	unsigned int ctrl;
+	unsigned short val = 0;
 
 	ctrl = inb(dev->iobase + PARPORT_CTRL_REG);
 	if (!(ctrl & PARPORT_CTRL_IRQ_ENA))
 		return IRQ_NONE;
 
-	comedi_buf_write_samples(s, &s->state, 1);
+	comedi_buf_write_samples(s, &val, 1);
 	comedi_handle_events(dev, s);
 
 	return IRQ_HANDLED;
-- 
2.30.0

_______________________________________________
devel mailing list
devel@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel

^ permalink raw reply related	[flat|nested] 15+ messages in thread

* [PATCH 12/14] staging: comedi: ni_6527: Use 16-bit 0 for interrupt data
  2021-02-23 14:30 [PATCH 00/14] staging: comedi: Fix some command data endian problems Ian Abbott
                   ` (10 preceding siblings ...)
  2021-02-23 14:30 ` [PATCH 11/14] staging: comedi: comedi_parport: " Ian Abbott
@ 2021-02-23 14:30 ` Ian Abbott
  2021-02-23 14:30 ` [PATCH 13/14] staging: comedi: ni_65xx: " Ian Abbott
  2021-02-23 14:30 ` [PATCH 14/14] staging: comedi: pcl726: " Ian Abbott
  13 siblings, 0 replies; 15+ messages in thread
From: Ian Abbott @ 2021-02-23 14:30 UTC (permalink / raw)
  To: devel; +Cc: Greg Kroah-Hartman, Ian Abbott

The ni_6527 driver has an "interrupt" subdevice that supports Comedi
asynchronous commands, placing a value in the Comedi buffer for each
interrupt.  The subdevice uses Comedi's 16-bit sample format but the
interrupt handler is calling `comedi_buf_write_samples()` with the
address of a 32-bit integer `&s->state`.  On bigendian machines, this
will copy 2 bytes from the wrong end of the 32-bit integer.  This isn't
really a problem since `s->state` will always be 0 for this subdevice,
but clean it up by using a 16-bit variable initialized to 0 to pass the
value.

Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
---
 drivers/staging/comedi/drivers/ni_6527.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/comedi/drivers/ni_6527.c b/drivers/staging/comedi/drivers/ni_6527.c
index 99e744172f4d..f1a45cf7342a 100644
--- a/drivers/staging/comedi/drivers/ni_6527.c
+++ b/drivers/staging/comedi/drivers/ni_6527.c
@@ -195,7 +195,9 @@ static irqreturn_t ni6527_interrupt(int irq, void *d)
 		return IRQ_NONE;
 
 	if (status & NI6527_STATUS_EDGE) {
-		comedi_buf_write_samples(s, &s->state, 1);
+		unsigned short val = 0;
+
+		comedi_buf_write_samples(s, &val, 1);
 		comedi_handle_events(dev, s);
 	}
 
-- 
2.30.0

_______________________________________________
devel mailing list
devel@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel

^ permalink raw reply related	[flat|nested] 15+ messages in thread

* [PATCH 13/14] staging: comedi: ni_65xx: Use 16-bit 0 for interrupt data
  2021-02-23 14:30 [PATCH 00/14] staging: comedi: Fix some command data endian problems Ian Abbott
                   ` (11 preceding siblings ...)
  2021-02-23 14:30 ` [PATCH 12/14] staging: comedi: ni_6527: " Ian Abbott
@ 2021-02-23 14:30 ` Ian Abbott
  2021-02-23 14:30 ` [PATCH 14/14] staging: comedi: pcl726: " Ian Abbott
  13 siblings, 0 replies; 15+ messages in thread
From: Ian Abbott @ 2021-02-23 14:30 UTC (permalink / raw)
  To: devel; +Cc: Greg Kroah-Hartman, Ian Abbott

The ni_65xx driver has an "interrupt" subdevice that supports Comedi
asynchronous commands, placing a value in the Comedi buffer for each
interrupt.  The subdevice uses Comedi's 16-bit sample format but the
interrupt handler is calling `comedi_buf_write_samples()` with the
address of a 32-bit integer `&s->state`.  On bigendian machines, this
will copy 2 bytes from the wrong end of the 32-bit integer.  This isn't
really a problem since `s->state` will always be 0 for this subdevice,
but clean it up by using a 16-bit variable initialized to 0 to pass the
value.

Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
---
 drivers/staging/comedi/drivers/ni_65xx.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/comedi/drivers/ni_65xx.c b/drivers/staging/comedi/drivers/ni_65xx.c
index eb3f9f7109da..7cd8497420f2 100644
--- a/drivers/staging/comedi/drivers/ni_65xx.c
+++ b/drivers/staging/comedi/drivers/ni_65xx.c
@@ -472,6 +472,7 @@ static irqreturn_t ni_65xx_interrupt(int irq, void *d)
 	struct comedi_device *dev = d;
 	struct comedi_subdevice *s = dev->read_subdev;
 	unsigned int status;
+	unsigned short val = 0;
 
 	status = readb(dev->mmio + NI_65XX_STATUS_REG);
 	if ((status & NI_65XX_STATUS_INT) == 0)
@@ -482,7 +483,7 @@ static irqreturn_t ni_65xx_interrupt(int irq, void *d)
 	writeb(NI_65XX_CLR_EDGE_INT | NI_65XX_CLR_OVERFLOW_INT,
 	       dev->mmio + NI_65XX_CLR_REG);
 
-	comedi_buf_write_samples(s, &s->state, 1);
+	comedi_buf_write_samples(s, &val, 1);
 	comedi_handle_events(dev, s);
 
 	return IRQ_HANDLED;
-- 
2.30.0

_______________________________________________
devel mailing list
devel@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel

^ permalink raw reply related	[flat|nested] 15+ messages in thread

* [PATCH 14/14] staging: comedi: pcl726: Use 16-bit 0 for interrupt data
  2021-02-23 14:30 [PATCH 00/14] staging: comedi: Fix some command data endian problems Ian Abbott
                   ` (12 preceding siblings ...)
  2021-02-23 14:30 ` [PATCH 13/14] staging: comedi: ni_65xx: " Ian Abbott
@ 2021-02-23 14:30 ` Ian Abbott
  13 siblings, 0 replies; 15+ messages in thread
From: Ian Abbott @ 2021-02-23 14:30 UTC (permalink / raw)
  To: devel; +Cc: Greg Kroah-Hartman, Ian Abbott

The pcl726 driver has an "interrupt" subdevice that supports Comedi
asynchronous commands, placing a value in the Comedi buffer for each
interrupt.  The subdevice uses Comedi's 16-bit sample format but the
interrupt handler is calling `comedi_buf_write_samples()` with the
address of a 32-bit integer `&s->state`.  On bigendian machines, this
will copy 2 bytes from the wrong end of the 32-bit integer.  This isn't
really a problem since `s->state` will always be 0 for this subdevice,
but clean it up by using a 16-bit variable initialized to 0 to pass the
value.

Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
---
 drivers/staging/comedi/drivers/pcl726.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/comedi/drivers/pcl726.c b/drivers/staging/comedi/drivers/pcl726.c
index 64eb649c9813..88f25d7e76f7 100644
--- a/drivers/staging/comedi/drivers/pcl726.c
+++ b/drivers/staging/comedi/drivers/pcl726.c
@@ -220,9 +220,11 @@ static irqreturn_t pcl726_interrupt(int irq, void *d)
 	struct pcl726_private *devpriv = dev->private;
 
 	if (devpriv->cmd_running) {
+		unsigned short val = 0;
+
 		pcl726_intr_cancel(dev, s);
 
-		comedi_buf_write_samples(s, &s->state, 1);
+		comedi_buf_write_samples(s, &val, 1);
 		comedi_handle_events(dev, s);
 	}
 
-- 
2.30.0

_______________________________________________
devel mailing list
devel@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel

^ permalink raw reply related	[flat|nested] 15+ messages in thread

end of thread, other threads:[~2021-02-23 14:32 UTC | newest]

Thread overview: 15+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-02-23 14:30 [PATCH 00/14] staging: comedi: Fix some command data endian problems Ian Abbott
2021-02-23 14:30 ` [PATCH 01/14] staging: comedi: addi_apci_1032: Fix endian problem for COS sample Ian Abbott
2021-02-23 14:30 ` [PATCH 02/14] staging: comedi: addi_apci_1500: Fix endian problem for command sample Ian Abbott
2021-02-23 14:30 ` [PATCH 03/14] staging: comedi: adv_pci1710: Fix endian problem for AI command data Ian Abbott
2021-02-23 14:30 ` [PATCH 04/14] staging: comedi: das6402: " Ian Abbott
2021-02-23 14:30 ` [PATCH 05/14] staging: comedi: das800: " Ian Abbott
2021-02-23 14:30 ` [PATCH 06/14] staging: comedi: dmm32at: " Ian Abbott
2021-02-23 14:30 ` [PATCH 07/14] staging: comedi: me4000: " Ian Abbott
2021-02-23 14:30 ` [PATCH 08/14] staging: comedi: pcl711: " Ian Abbott
2021-02-23 14:30 ` [PATCH 09/14] staging: comedi: pcl818: " Ian Abbott
2021-02-23 14:30 ` [PATCH 10/14] staging: comedi: amplc_pc236_common: Use 16-bit 0 for interrupt data Ian Abbott
2021-02-23 14:30 ` [PATCH 11/14] staging: comedi: comedi_parport: " Ian Abbott
2021-02-23 14:30 ` [PATCH 12/14] staging: comedi: ni_6527: " Ian Abbott
2021-02-23 14:30 ` [PATCH 13/14] staging: comedi: ni_65xx: " Ian Abbott
2021-02-23 14:30 ` [PATCH 14/14] staging: comedi: pcl726: " Ian Abbott

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).